digest	sha256:e240956daa1d041c8fd28499fe4f0bb9e779106910a7b9f05831cdf848cbe996
vulnerabilities
platform	linux/amd64
size	725 MB
packages	288

golang.org/x/crypto 0.45.0 (golang) pkg:golang/golang.org/x/crypto@0.45.0 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Incorrect Implementation of Authentication Algorithm Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 10 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L EPSS Score 0.503% EPSS Percentile 41st percentile Description Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. Improper Certificate Validation Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 7.314% EPSS Percentile 94th percentile Description Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. Integer Overflow or Wraparound Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H EPSS Score 0.525% EPSS Percentile 43rd percentile Description When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation. Missing Authorization Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.412% EPSS Percentile 34th percentile Description The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested. Improper Preservation of Permissions Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.600% EPSS Percentile 47th percentile Description When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them. Missing Authorization Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.420% EPSS Percentile 35th percentile Description The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback. Improper Restriction of Operations within the Bounds of a Memory Buffer Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H EPSS Score 0.621% EPSS Percentile 48th percentile Description A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded. Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.315% EPSS Percentile 24th percentile Description Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.378% EPSS Percentile 31st percentile Description Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.325% EPSS Percentile 25th percentile Description The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback. Incorrect Type Conversion or Cast Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.473% EPSS Percentile 39th percentile Description An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. Improper Validation of Specified Quantity in Input Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.467% EPSS Percentile 39th percentile Description The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2. Improper Enforcement of Message Integrity During Transmission in a Communication Channel Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.279% EPSS Percentile 20th percentile Description An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. Improper Preservation of Permissions Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 6.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L EPSS Score 0.369% EPSS Percentile 30th percentile Description When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. Improper Validation of Array Index Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.412% EPSS Percentile 34th percentile Description For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. Improper Certificate Validation Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.504% EPSS Percentile 41st percentile Description SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

golang.org/x/crypto 0.47.0 (golang) pkg:golang/golang.org/x/crypto@0.47.0 # mongo-8.dockerfile (125:125) COPY --from=builder /usr/local/bin/mongo* /usr/local/bin/bsondump /usr/bin/ Incorrect Implementation of Authentication Algorithm Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 10 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L EPSS Score 0.503% EPSS Percentile 41st percentile Description Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. Improper Certificate Validation Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 7.314% EPSS Percentile 94th percentile Description Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. Integer Overflow or Wraparound Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H EPSS Score 0.525% EPSS Percentile 43rd percentile Description When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation. Missing Authorization Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.412% EPSS Percentile 34th percentile Description The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested. Improper Preservation of Permissions Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.600% EPSS Percentile 47th percentile Description When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them. Missing Authorization Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 0.420% EPSS Percentile 35th percentile Description The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback. Improper Restriction of Operations within the Bounds of a Memory Buffer Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H EPSS Score 0.621% EPSS Percentile 48th percentile Description A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded. Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.315% EPSS Percentile 24th percentile Description Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.378% EPSS Percentile 31st percentile Description Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.325% EPSS Percentile 25th percentile Description The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback. Incorrect Type Conversion or Cast Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.473% EPSS Percentile 39th percentile Description An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. Improper Validation of Specified Quantity in Input Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.467% EPSS Percentile 39th percentile Description The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2. Improper Enforcement of Message Integrity During Transmission in a Communication Channel Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.279% EPSS Percentile 20th percentile Description An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. Improper Preservation of Permissions Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 6.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L EPSS Score 0.369% EPSS Percentile 30th percentile Description When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. Improper Validation of Array Index Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.412% EPSS Percentile 34th percentile Description For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. Improper Certificate Validation Affected range <0.52.0 Fixed version 0.52.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.504% EPSS Percentile 41st percentile Description SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

stdlib 1.24.6 (golang) pkg:golang/stdlib@1.24.6 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <1.24.13 Fixed version 1.24.13 EPSS Score 0.778% EPSS Percentile 54th percentile Description During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.692% EPSS Percentile 51st percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.560% EPSS Percentile 45th percentile Description Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.798% EPSS Percentile 54th percentile Description Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.588% EPSS Percentile 46th percentile Description The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.784% EPSS Percentile 54th percentile Description Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.781% EPSS Percentile 54th percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.813% EPSS Percentile 55th percentile Description When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.621% EPSS Percentile 48th percentile Description If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.355% EPSS Percentile 29th percentile Description Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.615% EPSS Percentile 47th percentile Description During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.728% EPSS Percentile 52nd percentile Description url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. Affected range <1.24.11 Fixed version 1.24.11 EPSS Score 0.457% EPSS Percentile 38th percentile Description Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption. Affected range <1.24.12 Fixed version 1.24.12 EPSS Score 2.128% EPSS Percentile 81st percentile Description The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.604% EPSS Percentile 47th percentile Description The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.617% EPSS Percentile 47th percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.356% EPSS Percentile 29th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.379% EPSS Percentile 31st percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.591% EPSS Percentile 46th percentile Description (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates. Affected range <1.24.12 Fixed version 1.24.12 EPSS Score 0.668% EPSS Percentile 50th percentile Description archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive. Affected range <1.24.11 Fixed version 1.24.11 EPSS Score 0.284% EPSS Percentile 21st percentile Description An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.292% EPSS Percentile 21st percentile Description On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.310% EPSS Percentile 23rd percentile Description Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.371% EPSS Percentile 30th percentile Description If a trusted template author were to write a </blockquote> </details> <a href="https://scout.docker.com/v/CVE-2026-39823?s=golang&n=stdlib&t=golang&vr=%3C1.25.10"><img alt="medium : CVE--2026--39823" src="https://img.shields.io/badge/CVE--2026--39823-lightgrey?label=medium%20&labelColor=fbb552"/></a> Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.314% EPSS Percentile 24th percentile Description CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.290% EPSS Percentile 21st percentile Description Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.328% EPSS Percentile 25th percentile Description Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.518% EPSS Percentile 42nd percentile Description Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.290% EPSS Percentile 21st percentile Description tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.370% EPSS Percentile 30th percentile Description When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.390% EPSS Percentile 32nd percentile Description ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function. Affected range <1.24.12 Fixed version 1.24.12 EPSS Score 0.286% EPSS Percentile 21st percentile Description During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.518% EPSS Percentile 42nd percentile Description The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.436% EPSS Percentile 37th percentile Description When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.527% EPSS Percentile 43rd percentile Description Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.518% EPSS Percentile 42nd percentile Description Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.436% EPSS Percentile 37th percentile Description The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.413% EPSS Percentile 35th percentile Description tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.201% EPSS Percentile 10th percentile Description On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.382% EPSS Percentile 31st percentile Description Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.232% EPSS Percentile 14th percentile Description On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

stdlib 1.25.9 (golang) pkg:golang/stdlib@1.25.9 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.692% EPSS Percentile 51st percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.560% EPSS Percentile 45th percentile Description Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.798% EPSS Percentile 54th percentile Description Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.588% EPSS Percentile 46th percentile Description The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.784% EPSS Percentile 54th percentile Description Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.568% EPSS Percentile 45th percentile Description Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.781% EPSS Percentile 54th percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.813% EPSS Percentile 55th percentile Description When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.591% EPSS Percentile 46th percentile Description (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.310% EPSS Percentile 23rd percentile Description Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.371% EPSS Percentile 30th percentile Description If a trusted template author were to write a </blockquote> </details> <a href="https://scout.docker.com/v/CVE-2026-39823?s=golang&n=stdlib&t=golang&vr=%3C1.25.10"><img alt="medium : CVE--2026--39823" src="https://img.shields.io/badge/CVE--2026--39823-lightgrey?label=medium%20&labelColor=fbb552"/></a> Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.314% EPSS Percentile 24th percentile Description CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS. Affected range <1.25.13 Fixed version 1.25.13 EPSS Score 0.518% EPSS Percentile 42nd percentile Description Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.370% EPSS Percentile 30th percentile Description When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.390% EPSS Percentile 32nd percentile Description ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.382% EPSS Percentile 31st percentile Description Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.232% EPSS Percentile 14th percentile Description On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

stdlib 1.26.5 (golang) pkg:golang/stdlib@1.26.5 # mongo-8.dockerfile (68:107) RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ ca-certificates \ curl \ libbrotli1 \ libcom-err2 \ libcurl4 \ libffi8 \ libgcc-s1 \ libgmp10 \ libgnutls30 \ libgssapi-krb5-2 \ libhogweed6 \ libidn2-0 \ libk5crypto3 \ libkeyutils1 \ libkrb5-3 \ libkrb5support0 \ libldap2 \ libnettle8 \ libnghttp2-14 \ libp11-kit0 \ libpsl5 \ librtmp1 \ libsasl2-2 \ libssh2-1 \ libssl3 \ libtasn1-6 \ libunistring5 \ libzstd1 \ numactl \ procps \ zlib1g \ yq \ wait-for-it \ && apt-get autoremove -y \ && apt-get autoclean \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.692% EPSS Percentile 51st percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.549% EPSS Percentile 44th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.310% EPSS Percentile 23rd percentile Description Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.518% EPSS Percentile 42nd percentile Description Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

golang.org/x/net 0.48.0 (golang) pkg:golang/golang.org/x/net@0.48.0 # mongo-8.dockerfile (125:125) COPY --from=builder /usr/local/bin/mongo* /usr/local/bin/bsondump /usr/bin/ Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.692% EPSS Percentile 51st percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.549% EPSS Percentile 44th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Affected range <0.53.0 Fixed version 0.53.0 EPSS Score 0.781% EPSS Percentile 54th percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Uncontrolled Resource Consumption Affected range <0.55.0 Fixed version 0.55.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.326% EPSS Percentile 25th percentile Description In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.235% EPSS Percentile 14th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

golang.org/x/net 0.47.0 (golang) pkg:golang/golang.org/x/net@0.47.0 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.692% EPSS Percentile 51st percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.549% EPSS Percentile 44th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Affected range <0.53.0 Fixed version 0.53.0 EPSS Score 0.781% EPSS Percentile 54th percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Uncontrolled Resource Consumption Affected range <0.55.0 Fixed version 0.55.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.326% EPSS Percentile 25th percentile Description In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.235% EPSS Percentile 14th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

js-yaml 3.13.1 (npm) pkg:npm/js-yaml@3.13.1 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Inefficient Algorithmic Complexity Affected range >=3.0.0 <3.15.1 Fixed version 3.15.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Quadratic CPU consumption in !!omap resolution (js-yaml 3.x and 4.x) Summary resolveYamlOmap() enforces key uniqueness for !!omap sequences with a linear scan (objectKeys.indexOf(...)) inside the per-element loop, making resolution O(n²) in the number of entries. A modestly sized YAML document therefore consumes disproportionate CPU inside yaml.load(), giving a denial of service against any consumer that parses untrusted YAML. !!omap is registered in the default schema (lib/schema/default.js → require('../type/omap')), so a plain yaml.load(untrustedInput) with no options is affected — no custom schema or non-default configuration is required. This is the same weakness as CVE-2026-59870 / GHSA-724g-mxrg-4qvm, which was fixed in the 5.x line in 5.2.1. That fix was never backported: both currently maintained legacy lines still carry the original implementation. Affected versions Line Latest tested Status 3.x 3.15.0 Affected — objectKeys.indexOf(pairKey) at lib/type/omap.js:29 4.x 4.3.0 Affected — objectKeys.indexOf(pairKey) at lib/type/omap.js:30 5.x 5.2.2 Not affected — fixed in 5.2.1 (uses a Set) Both figures are the newest release of each line at the time of writing, so this is not a "you are on an old version" issue. Details lib/type/omap.js (js-yaml 4.3.0): if (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey) else return false objectKeys grows by one element per entry, and Array.prototype.indexOf is a linear scan, so resolving an n-entry !!omap performs roughly 1 + 2 + … + n comparisons — quadratic in n. The work happens synchronously inside yaml.load(), blocking the event loop for its whole duration. The 5.x line already solves exactly this by tracking seen keys in a Set (src/tag/sequence/omap.ts): if (carrier.seen.has(key)) return 'duplicate key in ordered map' carrier.seen.add(key) Proof of concept // poc.js — node poc.js const yaml = require('js-yaml'); const doc = n => '!!omap\n' + Array.from({length: n}, (_, i) => `- k${i}: ${i}`).join('\n') + '\n'; for (const n of [10000, 20000, 40000, 80000]) { const d = doc(n), t = Date.now(); yaml.load(d); // default schema, no options console.log(`n=${n} bytes=${d.length} load=${Date.now() - t}ms`); } Measured (node v20.20.2, default heap, no flags) js-yaml 4.3.0 n=10000 bytes=137787 load=54ms n=20000 bytes=297787 load=169ms n=40000 bytes=617787 load=646ms n=80000 bytes=1257787 load=2607ms js-yaml 3.15.0 n=10000 bytes=137787 load=53ms n=20000 bytes=297787 load=166ms n=40000 bytes=617787 load=641ms n=80000 bytes=1257787 load=2567ms Runtime grows by a factor of ~4 for each doubling of n, which is the signature of O(n²) (linear growth would be ~2×). Scaling further: a 2.48 MB document with 150,000 entries blocked yaml.load() for 10.8 seconds. Impact Any service that parses attacker-influenced YAML with js-yaml 3.x or 4.x can be stalled with a small input. Because the loop is synchronous, a single request blocks the Node.js event loop and stalls every other request in the process — so the amplification is per-process, not just per-request. Suggested severity: consistent with CVE-2026-59870 (the same weakness in 5.x), i.e. Availability-only impact, network attack vector, no privileges or user interaction required. Suggested fix Mirror the 5.x fix — replace the linear scan with a Set: // lib/type/omap.js const seen = new Set() // ... if (seen.has(pairKey)) return false seen.add(pairKey) This preserves the existing duplicate-key rejection semantics exactly while making resolution O(n). A maxOmapLength-style cap would also work, but the Set matches what 5.x already ships and requires no new option. References CVE-2026-59870 / GHSA-724g-mxrg-4qvm — same weakness in 5.0.0–5.2.0, fixed in 5.2.1 lib/type/omap.js (3.x, 4.x) — the affected resolver lib/schema/default.js — registers !!omap in the default schema Discovery Found by an automated static-analysis and executed-proof-of-concept scanner run against js-yaml 4.2.0, then manually verified against 3.15.0 and 4.3.0 by executing the proof of concept above. All timings in this report were measured on the current releases of each line, not on the version originally scanned. Uncontrolled Resource Consumption Affected range >=3.0.0 <3.15.2 Fixed version 3.15.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.385% EPSS Percentile 32nd percentile Description Summary maxTotalMergeKeys does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit. Example arr: &arr [{}, {}, {}, ...] # N empty mappings targets: - <<: *arr # repeated K times For every target, the loader iterates all N elements of arr. This results in O(N * K) work while totalMergeKeys remains unchanged. PoC import { performance } from 'node:perf_hooks' import { load, YAML11_SCHEMA } from 'js-yaml' const n = 20000 const src = 'arr: &arr [' + '{},'.repeat(n).slice(0, -1) + ']\n' + 'targets:\n' + ' - <<: *arr\n'.repeat(n) const started = performance.now() load(src, { schema: YAML11_SCHEMA }) console.log(`${(performance.now() - started).toFixed(1)} ms`) Observed results: N YAML size Time 800 ~13 KB ~20 ms 3200 ~50 KB ~180 ms 20000 ~500 KB ~13 s Impact An attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default maxTotalMergeKeys limit. Fix Count each merge-source mapping as one budget unit, in addition to counting its keys. Difference with v5 In v3 & v4, merge is enabled by default. So, the severity score is higher. Uncontrolled Resource Consumption Affected range >=3.0.0 <3.15.0 Fixed version 3.15.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.544% EPSS Percentile 44th percentile Description Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: a0: &a0 { k0: 0 } a1: &a1 { <<: *a0, k1: 1 } a2: &a2 { <<: *a1, k2: 2 } a3: &a3 { <<: *a2, k3: 3 } ... b: *aN For each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size. PoC From N = 4000 delay become > 1s (doc size < 100K) import { performance } from 'node:perf_hooks' import { Buffer } from 'node:buffer' import { load, YAML11_SCHEMA } from 'js-yaml' const n = Number(process.argv[2] || 4000) function makeMergeChain (count) { const lines = ['a0: &a0 { k0: 0 }'] for (let i = 1; i < count; i++) { lines.push(`a${i}: &a${i} { <<: *a${i - 1}, k${i}: ${i} }`) } lines.push(`b: *a${count - 1}`) return `${lines.join('\n')}\n` } const source = makeMergeChain(n) console.log(source.split('\n').slice(0, 8).join('\n')) console.log('...') console.log(source.split('\n').slice(-4).join('\n')) console.log() console.log(`N: ${n}`) console.log(`YAML size: ${Buffer.byteLength(source)} bytes`) const started = performance.now() const result = load(source, { schema: YAML11_SCHEMA }) const elapsed = performance.now() - started console.log(`parse time: ${elapsed.toFixed(1)} ms`) console.log(`top-level keys: ${Object.keys(result).length}`) console.log(`b keys: ${Object.keys(result.b).length}`) Patches Fix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases. Inefficient Algorithmic Complexity Affected range <3.15.0 Fixed version 4.2.0 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.386% EPSS Percentile 32nd percentile Description Summary A crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. Details The issue is in merge handling inside lib/loader.js: storeMappingPair(...) iterates every element of a merge sequence when key tag is tag:yaml.org,2002:merge. For each element, it calls mergeMappings(...). mergeMappings(...) computes Object.keys(source) and performs _hasOwnProperty.call(destination, key) checks for each key. When input is of the form: a: &a {k0:0, k1:0, ..., kK:0} b: {<<: [*a, *a, *a, ... repeated M times ...]} all *a entries refer to the same anchored object. After the first merge, subsequent merges are semantically no-ops, but the parser still reprocesses all keys each time. Resulting work is O(K * M), while input size is O(K + M), giving quadratic scaling as payload grows. Relevant code path: lib/loader.js in storeMappingPair(...) merge branch (keyTag === 'tag:yaml.org,2002:merge') lib/loader.js mergeMappings(...) Root cause File: lib/loader.js Function: storeMappingPair(state, _result, overridableKeys, keyTag, keyNode, valueNode, startLine, startLineStart, startPos) Lines: ~359-366 if (keyTag === 'tag:yaml.org,2002:merge') { if (Array.isArray(valueNode)) { for (index = 0, quantity = valueNode.length; index < quantity; index += 1) { mergeMappings(state, _result, valueNode[index], overridableKeys); } } else { mergeMappings(state, _result, valueNode, overridableKeys); } } When the merge value is a sequence (YAML 1.1 <<: [ *a, *a, ... ]), each element is handed to mergeMappings() without deduplication. mergeMappings() then does sourceKeys = Object.keys(source); for (index = 0; index < sourceKeys.length; index += 1) { key = sourceKeys[index]; if (!_hasOwnProperty.call(destination, key)) { setProperty(destination, key, source[key]); overridableKeys[key] = true; } } Every alias reference in the sequence resolves (by design) to the SAME object via state.anchorMap. After the first merge, every subsequent merge of that same reference is a pure no-op semantically, but still performs: one Object.keys(source) call (O(K)) K _hasOwnProperty.call checks on the destination Total: M * K hasOwnProperty checks + M Object.keys allocations, while the final object and all observable side effects are identical to a single merge. YAML semantics for <<: are idempotent and commutative over duplicate sources, so collapsing duplicates preserves behavior exactly; this isn't a spec trade-off. PoC Environment: js-yaml version: 4.1.1 Node.js: v24.5.0 Platform: arm64 macOS (reproduced consistently) Reproduction script: Create many keys in one anchored map (&a). Merge that same alias repeatedly via <<: [*a, *a, ...]. Measure parse time and compare with control payload using single merge (<<: *a). Observed repeated runs (same machine): K=M=1000, input 9,909 bytes: ~33–36 ms K=M=2000, input 20,909 bytes: ~121–123 ms K=M=4000, input 42,909 bytes: ~524–537 ms K=M=6000, input 64,909 bytes: ~1,608–1,829 ms K=M=8000, input 86,909 bytes: ~3,395–3,565 ms Control (single merge, similar key counts): K=2000: ~1–2 ms K=4000: ~3 ms K=8000: ~5 ms Also verified: repeated-merge output equals single-merge output (same key count and same JSON), confirming excess time is redundant computation. Impact This is a denial-of-service vulnerability (CPU exhaustion / algorithmic complexity). Any service parsing untrusted YAML with js-yaml can be impacted, including API backends, CI tools, config processors, and automation services. An attacker can submit crafted YAML to significantly increase CPU time and reduce availability. Suggested fix: Dedupe the merge source list by reference before invoking mergeMappings. Any of the following are minimal and preserve YAML 1.1 merge semantics: dedupe in storeMappingPair: if (keyTag === 'tag:yaml.org,2002:merge') { if (Array.isArray(valueNode)) { var seen = new Set(); for (index = 0, quantity = valueNode.length; index < quantity; index += 1) { var src = valueNode[index]; if (seen.has(src)) continue; // idempotent; skip redundant alias seen.add(src); mergeMappings(state, _result, src, overridableKeys); } } else { mergeMappings(state, _result, valueNode, overridableKeys); } } Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Affected range <3.14.2 Fixed version 4.1.1 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N EPSS Score 0.408% EPSS Percentile 34th percentile Description Impact In js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted. Patches Problem is patched in js-yaml 4.1.1 and 3.14.2. Workarounds You can protect against this kind of attack on the server by using node --disable-proto=delete or deno (in Deno, pollution protection is on by default). References https://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html

golang.org/x/crypto 0.54.0 (golang) pkg:golang/golang.org/x/crypto@0.54.0 # mongo-8.dockerfile (68:107) RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ ca-certificates \ curl \ libbrotli1 \ libcom-err2 \ libcurl4 \ libffi8 \ libgcc-s1 \ libgmp10 \ libgnutls30 \ libgssapi-krb5-2 \ libhogweed6 \ libidn2-0 \ libk5crypto3 \ libkeyutils1 \ libkrb5-3 \ libkrb5support0 \ libldap2 \ libnettle8 \ libnghttp2-14 \ libp11-kit0 \ libpsl5 \ librtmp1 \ libsasl2-2 \ libssh2-1 \ libssl3 \ libtasn1-6 \ libunistring5 \ libzstd1 \ numactl \ procps \ zlib1g \ yq \ wait-for-it \ && apt-get autoremove -y \ && apt-get autoclean \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.315% EPSS Percentile 24th percentile Description Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection. Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.378% EPSS Percentile 31st percentile Description Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.325% EPSS Percentile 25th percentile Description The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback. Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

expat 2.6.1-2ubuntu0.4 (deb) pkg:deb/ubuntu/expat@2.6.1-2ubuntu0.4?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (68:107) RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ ca-certificates \ curl \ libbrotli1 \ libcom-err2 \ libcurl4 \ libffi8 \ libgcc-s1 \ libgmp10 \ libgnutls30 \ libgssapi-krb5-2 \ libhogweed6 \ libidn2-0 \ libk5crypto3 \ libkeyutils1 \ libkrb5-3 \ libkrb5support0 \ libldap2 \ libnettle8 \ libnghttp2-14 \ libp11-kit0 \ libpsl5 \ librtmp1 \ libsasl2-2 \ libssh2-1 \ libssl3 \ libtasn1-6 \ libunistring5 \ libzstd1 \ numactl \ procps \ zlib1g \ yq \ wait-for-it \ && apt-get autoremove -y \ && apt-get autoclean \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* Affected range >=0 Fixed version Not Fixed CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.460% EPSS Percentile 38th percentile Description In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in getAttributeId. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in addBinding. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in storeAtts. Affected range >=0 Fixed version Not Fixed CVSS Score 6.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L EPSS Score 0.108% EPSS Percentile 1st percentile Description In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. Affected range >=0 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L EPSS Score 0.186% EPSS Percentile 8th percentile Description libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. Affected range >=0 Fixed version Not Fixed CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L EPSS Score 0.181% EPSS Percentile 8th percentile Description libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.171% EPSS Percentile 7th percentile Description libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.216% EPSS Percentile 12th percentile Description libexpat before 2.7.5 allows an infinite loop while parsing DTD content. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.164% EPSS Percentile 6th percentile Description libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.203% EPSS Percentile 10th percentile Description In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. Affected range >=0 Fixed version Not Fixed EPSS Score 0.108% EPSS Percentile 1st percentile Description libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412. Affected range >=0 Fixed version Not Fixed EPSS Score 0.353% EPSS Percentile 28th percentile Description Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046. Affected range >=0 Fixed version Not Fixed EPSS Score 0.194% EPSS Percentile 9th percentile Description libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions. Affected range >=0 Fixed version Not Fixed EPSS Score 0.586% EPSS Percentile 46th percentile Description Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. Affected range >=0 Fixed version Not Fixed EPSS Score 0.134% EPSS Percentile 3rd percentile Description xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. Affected range >=0 Fixed version Not Fixed EPSS Score 0.140% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in copyString. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. Affected range >=0 Fixed version Not Fixed EPSS Score 0.139% EPSS Percentile 4th percentile Description libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. Affected range >=0 Fixed version Not Fixed EPSS Score 0.182% EPSS Percentile 8th percentile Description libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). Affected range >=0 Fixed version Not Fixed EPSS Score 0.398% EPSS Percentile 33rd percentile Description libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. Affected range >=0 Fixed version Not Fixed EPSS Score 1.315% EPSS Percentile 69th percentile Description libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

perl 5.38.2-3.2ubuntu0.3 (deb) pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H EPSS Score 0.432% EPSS Percentile 36th percentile Description Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 CVSS Score 8.4 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.211% EPSS Percentile 11th percentile Description Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.448% EPSS Percentile 38th percentile Description Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 EPSS Score 0.247% EPSS Percentile 16th percentile Description HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, _maybe_redirect follows the Location: header and _prepare_headers_and_cb re-merges the caller's headers argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied Authorization, Cookie and Proxy-Authorization headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including https to http downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 EPSS Score 0.357% EPSS Percentile 29th percentile Description Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 EPSS Score 0.292% EPSS Percentile 21st percentile Description IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 EPSS Score 0.373% EPSS Percentile 31st percentile Description IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap. Affected range >=0 Fixed version Not Fixed EPSS Score 0.418% EPSS Percentile 35th percentile Description Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong. Affected range >=0 Fixed version Not Fixed EPSS Score 0.161% EPSS Percentile 6th percentile Description Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 EPSS Score 0.374% EPSS Percentile 31st percentile Description Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure. Affected range <5.38.2-3.2ubuntu0.4 Fixed version 5.38.2-3.2ubuntu0.4 EPSS Score 0.127% EPSS Percentile 3rd percentile Description IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

util-linux 2.39.3-9ubuntu6.5 (deb) pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <2.39.3-9ubuntu6.6 Fixed version 2.39.3-9ubuntu6.6 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H EPSS Score 0.168% EPSS Percentile 6th percentile Description A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service. Affected range <2.39.3-9ubuntu6.6 Fixed version 2.39.3-9ubuntu6.6 Description [Integer Overflow or Wraparound in libblkid/src/partitions/dos.c] Affected range <2.39.3-9ubuntu6.6 Fixed version 2.39.3-9ubuntu6.6 Description [Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)] Affected range <2.39.3-9ubuntu6.6 Fixed version 2.39.3-9ubuntu6.6 Description [Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection] Affected range <2.39.3-9ubuntu6.6 Fixed version 2.39.3-9ubuntu6.6 Description [Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown] Affected range <2.39.3-9ubuntu6.6 Fixed version 2.39.3-9ubuntu6.6 EPSS Score 0.118% EPSS Percentile 2nd percentile Description util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

libssh 0.10.6-2ubuntu0.4 (deb) pkg:deb/ubuntu/libssh@0.10.6-2ubuntu0.4?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <0.10.6-2ubuntu0.5 Fixed version 0.10.6-2ubuntu0.5 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.346% EPSS Percentile 28th percentile Description A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. Affected range <0.10.6-2ubuntu0.5 Fixed version 0.10.6-2ubuntu0.5 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N EPSS Score 0.332% EPSS Percentile 26th percentile Description A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection. Affected range <0.10.6-2ubuntu0.5 Fixed version 0.10.6-2ubuntu0.5 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H EPSS Score 0.104% EPSS Percentile 1st percentile Description A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service. Affected range <0.10.6-2ubuntu0.5 Fixed version 0.10.6-2ubuntu0.5 EPSS Score 0.341% EPSS Percentile 27th percentile Description A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. Affected range <0.10.6-2ubuntu0.5 Fixed version 0.10.6-2ubuntu0.5 EPSS Score 0.120% EPSS Percentile 2nd percentile Description A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. Affected range <0.10.6-2ubuntu0.5 Fixed version 0.10.6-2ubuntu0.5 EPSS Score 0.567% EPSS Percentile 45th percentile Description A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

jq 1.7.1-3ubuntu0.24.04.2 (deb) pkg:deb/ubuntu/jq@1.7.1-3ubuntu0.24.04.2?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.161% EPSS Percentile 6th percentile Description jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two otherwise valid modules include each other. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.154% EPSS Percentile 5th percentile Description jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects. Affected range >=0 Fixed version Not Fixed CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.142% EPSS Percentile 4th percentile Description jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond ≈1 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets. Affected range >=0 Fixed version Not Fixed EPSS Score 0.157% EPSS Percentile 5th percentile Description jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens. Affected range >=0 Fixed version Not Fixed EPSS Score 0.158% EPSS Percentile 5th percentile Description jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.

libssh2 1.11.0-4.1ubuntu0.24.04.3 (deb) pkg:deb/ubuntu/libssh2@1.11.0-4.1ubuntu0.24.04.3?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (68:107) RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ ca-certificates \ curl \ libbrotli1 \ libcom-err2 \ libcurl4 \ libffi8 \ libgcc-s1 \ libgmp10 \ libgnutls30 \ libgssapi-krb5-2 \ libhogweed6 \ libidn2-0 \ libk5crypto3 \ libkeyutils1 \ libkrb5-3 \ libkrb5support0 \ libldap2 \ libnettle8 \ libnghttp2-14 \ libp11-kit0 \ libpsl5 \ librtmp1 \ libsasl2-2 \ libssh2-1 \ libssl3 \ libtasn1-6 \ libunistring5 \ libzstd1 \ numactl \ procps \ zlib1g \ yq \ wait-for-it \ && apt-get autoremove -y \ && apt-get autoclean \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* Affected range <1.11.0-4.1ubuntu0.24.04.4 Fixed version 1.11.0-4.1ubuntu0.24.04.4 EPSS Score 0.472% EPSS Percentile 39th percentile Description libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication. Affected range <1.11.0-4.1ubuntu0.24.04.4 Fixed version 1.11.0-4.1ubuntu0.24.04.4 EPSS Score 0.583% EPSS Percentile 46th percentile Description libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs. Affected range <1.11.0-4.1ubuntu0.24.04.4 Fixed version 1.11.0-4.1ubuntu0.24.04.4 EPSS Score 0.448% EPSS Percentile 38th percentile Description libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

openssl 3.0.13-0ubuntu3.12 (deb) pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <3.0.13-0ubuntu3.15 Fixed version 3.0.13-0ubuntu3.15 EPSS Score 1.330% EPSS Percentile 69th percentile Description Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. Affected range <3.0.13-0ubuntu3.15 Fixed version 3.0.13-0ubuntu3.15 EPSS Score 0.612% EPSS Percentile 47th percentile Description Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. Affected range <3.0.13-0ubuntu3.15 Fixed version 3.0.13-0ubuntu3.15 EPSS Score 0.207% EPSS Percentile 11th percentile Description Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module. Affected range <3.0.13-0ubuntu3.15 Fixed version 3.0.13-0ubuntu3.15 EPSS Score 0.488% EPSS Percentile 40th percentile Description Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE. Affected range <3.0.13-0ubuntu3.15 Fixed version 3.0.13-0ubuntu3.15 EPSS Score 0.516% EPSS Percentile 42nd percentile Description Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell

p11-kit 0.25.3-4ubuntu2.1 (deb) pkg:deb/ubuntu/p11-kit@0.25.3-4ubuntu2.1?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <0.25.3-4ubuntu2.2 Fixed version 0.25.3-4ubuntu2.2 EPSS Score 0.107% EPSS Percentile 1st percentile Description A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems. Affected range <0.25.3-4ubuntu2.2 Fixed version 0.25.3-4ubuntu2.2 EPSS Score 0.148% EPSS Percentile 4th percentile Description A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

tar 1.35+dfsg-3ubuntu0.4 (deb) pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range >=0 Fixed version Not Fixed EPSS Score 0.141% EPSS Percentile 4th percentile Description A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction. Affected range >=0 Fixed version Not Fixed EPSS Score 0.080% EPSS Percentile 0th percentile Description A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue.

curl 8.5.0-2ubuntu10.11 (deb) pkg:deb/ubuntu/curl@8.5.0-2ubuntu10.11?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <8.5.0-2ubuntu10.12 Fixed version 8.5.0-2ubuntu10.12 EPSS Score 0.688% EPSS Percentile 50th percentile Description Successfully using libcurl to do a transfer to a specific HTTP origin (hostA) with Digest authentication and then changing the origin to a different one (hostB) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB. Affected range <8.5.0-2ubuntu10.13 Fixed version 8.5.0-2ubuntu10.13 EPSS Score 0.396% EPSS Percentile 33rd percentile Description libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key.

attr 1:2.5.2-1build1.1 (deb) pkg:deb/ubuntu/attr@1%3A2.5.2-1build1.1?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <1:2.5.2-1ubuntu0.1 Fixed version 1:2.5.2-1ubuntu0.1 EPSS Score 0.140% EPSS Percentile 4th percentile Description attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.

diffutils 1:3.10-1build1 (deb) pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <1:3.10-1ubuntu0.1 Fixed version 1:3.10-1ubuntu0.1 EPSS Score 0.332% EPSS Percentile 26th percentile Description diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.

dpkg 1.22.6ubuntu6.6 (deb) pkg:deb/ubuntu/dpkg@1.22.6ubuntu6.6?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range >=0 Fixed version Not Fixed EPSS Score 0.418% EPSS Percentile 35th percentile Description It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

sqlite3 3.45.1-1ubuntu2.7 (deb) pkg:deb/ubuntu/sqlite3@3.45.1-1ubuntu2.7?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (68:107) RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ ca-certificates \ curl \ libbrotli1 \ libcom-err2 \ libcurl4 \ libffi8 \ libgcc-s1 \ libgmp10 \ libgnutls30 \ libgssapi-krb5-2 \ libhogweed6 \ libidn2-0 \ libk5crypto3 \ libkeyutils1 \ libkrb5-3 \ libkrb5support0 \ libldap2 \ libnettle8 \ libnghttp2-14 \ libp11-kit0 \ libpsl5 \ librtmp1 \ libsasl2-2 \ libssh2-1 \ libssl3 \ libtasn1-6 \ libunistring5 \ libzstd1 \ numactl \ procps \ zlib1g \ yq \ wait-for-it \ && apt-get autoremove -y \ && apt-get autoclean \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* Affected range >=0 Fixed version Not Fixed EPSS Score 0.211% EPSS Percentile 11th percentile Description Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components

go.mongodb.org/mongo-driver 1.17.3 (golang) pkg:golang/go.mongodb.org/mongo-driver@1.17.3 # mongo-8.dockerfile (125:125) COPY --from=builder /usr/local/bin/mongo* /usr/local/bin/bsondump /usr/bin/ Permissive List of Allowed Inputs Affected range <1.17.7 Fixed version 1.17.7 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N EPSS Score 0.223% EPSS Percentile 13th percentile Description The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

glibc 2.39-0ubuntu8.8 (deb) pkg:deb/ubuntu/glibc@2.39-0ubuntu8.8?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range >=0 Fixed version Not Fixed EPSS Score 0.150% EPSS Percentile 4th percentile Description Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

golang.org/x/sys 0.1.0 (golang) pkg:golang/golang.org/x/sys@0.1.0 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <0.44.0 Fixed version 0.44.0 EPSS Score 0.114% EPSS Percentile 2nd percentile Description NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

gnupg2 2.4.4-2ubuntu17.4 (deb) pkg:deb/ubuntu/gnupg2@2.4.4-2ubuntu17.4?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <2.4.4-2ubuntu17.6 Fixed version 2.4.4-2ubuntu17.6 EPSS Score 0.142% EPSS Percentile 4th percentile Description CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

systemd 255.4-1ubuntu8.17 (deb) pkg:deb/ubuntu/systemd@255.4-1ubuntu8.17?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range >=0 Fixed version Not Fixed CVSS Score 3.3 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N EPSS Score 0.173% EPSS Percentile 7th percentile Description In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.

coreutils 9.4-3ubuntu6.2 (deb) pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <9.4-3ubuntu6.3 Fixed version 9.4-3ubuntu6.3 EPSS Score 0.266% EPSS Percentile 18th percentile Description A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

golang.org/x/sys 0.38.0 (golang) pkg:golang/golang.org/x/sys@0.38.0 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <0.44.0 Fixed version 0.44.0 EPSS Score 0.114% EPSS Percentile 2nd percentile Description NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

shadow 1:4.13+dfsg1-4ubuntu3.2 (deb) pkg:deb/ubuntu/shadow@1%3A4.13%2Bdfsg1-4ubuntu3.2?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range >=0 Fixed version Not Fixed EPSS Score 0.423% EPSS Percentile 36th percentile Description shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

ncurses 6.4+20240113-1ubuntu2.1 (deb) pkg:deb/ubuntu/ncurses@6.4%2B20240113-1ubuntu2.1?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <6.4+20240113-1ubuntu2.2 Fixed version 6.4+20240113-1ubuntu2.2 EPSS Score 0.183% EPSS Percentile 8th percentile Description A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.

golang.org/x/sys 0.33.0 (golang) pkg:golang/golang.org/x/sys@0.33.0 # mongo-8.dockerfile (132:132) RUN chmod -R g+rwX /opt/bitnami Affected range <0.44.0 Fixed version 0.44.0 EPSS Score 0.114% EPSS Percentile 2nd percentile Description NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

bzip2 1.0.8-5.1build0.1 (deb) pkg:deb/ubuntu/bzip2@1.0.8-5.1build0.1?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <1.0.8-5.1ubuntu0.1 Fixed version 1.0.8-5.1ubuntu0.1 EPSS Score 0.126% EPSS Percentile 3rd percentile Description bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

golang.org/x/sys 0.40.0 (golang) pkg:golang/golang.org/x/sys@0.40.0 # mongo-8.dockerfile (125:125) COPY --from=builder /usr/local/bin/mongo* /usr/local/bin/bsondump /usr/bin/ Affected range <0.44.0 Fixed version 0.44.0 EPSS Score 0.114% EPSS Percentile 2nd percentile Description NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

zlib 1:1.3.dfsg-3.1ubuntu2.1 (deb) pkg:deb/ubuntu/zlib@1%3A1.3.dfsg-3.1ubuntu2.1?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <1:1.3.dfsg-3.1ubuntu2.2 Fixed version 1:1.3.dfsg-3.1ubuntu2.2 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.218% EPSS Percentile 12th percentile Description zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

libgcrypt20 1.10.3-2ubuntu0.1 (deb) pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?os_distro=noble&os_name=ubuntu&os_version=24.04 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <1.10.3-2ubuntu0.2 Fixed version 1.10.3-2ubuntu0.2 EPSS Score 1.114% EPSS Percentile 64th percentile Description A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

golang.org/x/text 0.31.0 (golang) pkg:golang/golang.org/x/text@0.31.0 # mongo-8.dockerfile (57:57) FROM mongo:8.3.8 Affected range <0.39.0 Fixed version 0.39.0 EPSS Score 0.475% EPSS Percentile 39th percentile Description A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

golang.org/x/text 0.33.0 (golang) pkg:golang/golang.org/x/text@0.33.0 # mongo-8.dockerfile (125:125) COPY --from=builder /usr/local/bin/mongo* /usr/local/bin/bsondump /usr/bin/ Affected range <0.39.0 Fixed version 0.39.0 EPSS Score 0.475% EPSS Percentile 39th percentile Description A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

github.com/klauspost/compress 1.18.6 (golang) pkg:golang/github.com/klauspost/compress@1.18.6 # mongo-8.dockerfile (68:107) RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ ca-certificates \ curl \ libbrotli1 \ libcom-err2 \ libcurl4 \ libffi8 \ libgcc-s1 \ libgmp10 \ libgnutls30 \ libgssapi-krb5-2 \ libhogweed6 \ libidn2-0 \ libk5crypto3 \ libkeyutils1 \ libkrb5-3 \ libkrb5support0 \ libldap2 \ libnettle8 \ libnghttp2-14 \ libp11-kit0 \ libpsl5 \ librtmp1 \ libsasl2-2 \ libssh2-1 \ libssl3 \ libtasn1-6 \ libunistring5 \ libzstd1 \ numactl \ procps \ zlib1g \ yq \ wait-for-it \ && apt-get autoremove -y \ && apt-get autoclean \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* Affected range >=1.16.0 <1.18.7 Fixed version 1.18.7 Description Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

github.com/klauspost/compress 1.17.8 (golang) pkg:golang/github.com/klauspost/compress@1.17.8 # mongo-8.dockerfile (125:125) COPY --from=builder /usr/local/bin/mongo* /usr/local/bin/bsondump /usr/bin/ Affected range >=1.16.0 <1.18.7 Fixed version 1.18.7 Description Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.