apk package
chainguard/mlrun-api-fips
pkg:apk/chainguard/mlrun-api-fips
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-15925 | Cri | — | < 1.11.0-r1 | 1.11.0-r1 | Jul 16, 2026 | Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access cou | |
| CVE-2026-10143 | Hig | 7.5 | < 1.11.0-r2 | 1.11.0-r2 | Jun 10, 2026 | kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_serv | |
| CVE-2026-10142 | Hig | 7.5 | < 1.11.0-r2 | 1.11.0-r2 | Jun 10, 2026 | kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers |
- affected < 1.11.0-r1fixed 1.11.0-r1
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access cou
- affected < 1.11.0-r2fixed 1.11.0-r2
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_serv
- affected < 1.11.0-r2fixed 1.11.0-r2
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers