chainguard/datadog-agent-7.71

Vulnerabilities (58)

• CVE-2026-33186CriMar 20, 2026
  affected < 7.71.2-r15fixed 7.71.2-r15

  gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omi

• CVE-2026-27142MedMar 6, 2026
  affected < 7.71.2-r16fixed 7.71.2-r16

  Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escap

• CVE-2026-27139LowMar 6, 2026
  affected < 7.71.2-r16fixed 7.71.2-r16

  On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary

• CVE-2026-25679HigMar 6, 2026
  affected < 7.71.2-r16fixed 7.71.2-r16

  url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

• CVE-2026-27141HigFeb 26, 2026
  affected < 7.71.2-r16fixed 7.71.2-r16

  Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

• CVE-2026-24051HigFeb 2, 2026
  affected < 7.71.2-r15fixed 7.71.2-r15

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system comman

• CVE-2026-1703LowFeb 2, 2026
  affected < 7.71.2-r11fixed 7.71.2-r11

  When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situat

• CVE-2026-24049Jan 22, 2026
  affected < 7.71.2-r9fixed 7.71.2-r9

  wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the fil

• CVE-2026-23949Jan 20, 2026
  affected < 7.71.2-r8fixed 7.71.2-r8

  jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow atta

• CVE-2026-21441Jan 7, 2026
  affected < 7.71.2-r17fixed 7.71.2-r17

  urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression b

• CVE-2025-69277MedDec 31, 2025
  affected < 7.71.2-r6fixed 7.71.2-r6

  libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic g

• CVE-2025-66471Dec 5, 2025
  affected < 7.71.2-r22fixed 7.71.2-r22

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chu

• CVE-2025-66418Dec 5, 2025
  affected < 7.71.2-r22fixed 7.71.2-r22

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage a

• CVE-2025-64329Nov 7, 2025
  affected < 7.71.2-r6fixed 7.71.2-r6

  containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks

• CVE-2025-52881Nov 6, 2025
  affected < 7.71.2-r6fixed 7.71.2-r6

  runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have

• CVE-2024-25621Nov 6, 2025
  affected < 7.71.2-r6fixed 7.71.2-r6

  containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd

• CVE-2025-50181Jun 19, 2025
  affected < 7.71.2-r22fixed 7.71.2-r22

  urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An appl

• CVE-2025-47273May 17, 2025
  affected < 0fixed 0

  setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on