apk package
chainguard/gitea
pkg:apk/chainguard/gitea
Vulnerabilities (71)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-46603 | Hig | 7.5 | < 1.27.2-r1 | 1.27.2-r1 | Aug 14, 2026 | VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion. | |
| CVE-2026-56865 | Hig | 8.4 | < 0 | 0 | Aug 13, 2026 | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious modul | |
| CVE-2026-56864 | Hig | 7.5 | < 0 | 0 | Aug 13, 2026 | A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order | |
| CVE-2026-71557 | Med | 6.3 | < 1.27.1-r1 | 1.27.1-r1 | Aug 7, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example con | |
| CVE-2026-71556 | Hig | 7.1 | < 1.27.1-r1 | 1.27.1-r1 | Aug 7, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a malicious | |
| CVE-2026-56852 | Hig | 7.5 | < 1.27.0-r3 | 1.27.0-r3 | Jul 21, 2026 | A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. | |
| CVE-2026-42505 | Med | 5.3 | < 1.26.4-r2 | 1.26.4-r2 | Jul 8, 2026 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. | |
| CVE-2026-39822 | Hig | 7.8 | < 0 | 0 | Jul 8, 2026 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symb | |
| CVE-2026-46602 | Hig | 7.5 | < 0 | 0 | Jun 25, 2026 | The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. | |
| CVE-2026-46601 | Hig | 7.5 | < 1.26.4-r1 | 1.26.4-r1 | Jun 25, 2026 | The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. | |
| CVE-2026-45571 | Med | 5.4 | < 1.26.2-r0 | 1.26.2-r0 | May 27, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These v | |
| CVE-2026-45570 | Cri | 9.6 | < 1.26.2-r0 | 1.26.2-r0 | May 27, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A reposito | |
| CVE-2026-45022 | Hig | 7.5 | < 1.25.5-r9 | 1.25.5-r9 | May 27, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representa | |
| CVE-2026-42506 | Med | 6.1 | < 1.26.2-r3 | 1.26.2-r3 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-42502 | Med | 6.1 | < 1.26.2-r3 | 1.26.2-r3 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-27136 | Med | 6.1 | < 1.26.2-r3 | 1.26.2-r3 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-25681 | Med | 6.1 | < 1.26.2-r3 | 1.26.2-r3 | May 22, 2026 | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. | |
| CVE-2026-25680 | Med | 6.5 | < 1.26.2-r3 | 1.26.2-r3 | May 22, 2026 | Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. | |
| CVE-2026-46598 | Med | 5.3 | < 0 | 0 | May 22, 2026 | For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. | |
| CVE-2026-46597 | Hig | 7.5 | < 1.26.2-r2 | 1.26.2-r2 | May 22, 2026 | An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. |
- affected < 1.27.2-r1fixed 1.27.2-r1
VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.
- affected < 0fixed 0
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious modul
- affected < 0fixed 0
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order
- affected < 1.27.1-r1fixed 1.27.1-r1
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example con
- affected < 1.27.1-r1fixed 1.27.1-r1
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a malicious
- affected < 1.27.0-r3fixed 1.27.0-r3
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
- affected < 1.26.4-r2fixed 1.26.4-r2
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
- affected < 0fixed 0
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symb
- affected < 0fixed 0
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
- affected < 1.26.4-r1fixed 1.26.4-r1
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
- affected < 1.26.2-r0fixed 1.26.2-r0
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These v
- affected < 1.26.2-r0fixed 1.26.2-r0
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A reposito
- affected < 1.25.5-r9fixed 1.25.5-r9
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representa
- affected < 1.26.2-r3fixed 1.26.2-r3
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.26.2-r3fixed 1.26.2-r3
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.26.2-r3fixed 1.26.2-r3
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.26.2-r3fixed 1.26.2-r3
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- affected < 1.26.2-r3fixed 1.26.2-r3
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
- affected < 0fixed 0
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
- affected < 1.26.2-r2fixed 1.26.2-r2
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Page 1 of 4