apk package
chainguard/rke2-runtime-1.31
pkg:apk/chainguard/rke2-runtime-1.31
Vulnerabilities (53)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-32280 | Hig | 7.5 | < 1.31.14.2.2-r1 | 1.31.14.2.2-r1 | Apr 8, 2026 | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls | |
| CVE-2026-27144 | Hig | 7.1 | < 1.31.14.2.2-r1 | 1.31.14.2.2-r1 | Apr 8, 2026 | The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime. | |
| CVE-2026-27143 | Cri | 9.8 | < 1.31.14.2.2-r1 | 1.31.14.2.2-r1 | Apr 8, 2026 | Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption. | |
| CVE-2026-27140 | Hig | 8.8 | < 1.31.14.2.2-r1 | 1.31.14.2.2-r1 | Apr 8, 2026 | SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. | |
| CVE-2026-33817 | — | < 1.31.14.2.2-r0 | 1.31.14.2.2-r0 | Apr 6, 2026 | Rejected reason: CVE confirmed to be a false positive | ||
| CVE-2026-27142 | Med | 6.1 | < 1.31.14.2.2-r0 | 1.31.14.2.2-r0 | Mar 6, 2026 | Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escap | |
| CVE-2026-27139 | Low | 2.5 | < 1.31.14.2.2-r0 | 1.31.14.2.2-r0 | Mar 6, 2026 | On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary | |
| CVE-2026-25679 | Hig | 7.5 | < 1.31.14.2.2-r0 | 1.31.14.2.2-r0 | Mar 6, 2026 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. | |
| CVE-2026-26958 | Low | — | < 1.31.14.2.1-r8 | 1.31.14.2.1-r8 | Feb 19, 2026 | filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Poin | |
| CVE-2026-21438 | — | < 1.31.14.2.1-r8 | 1.31.14.2.1-r8 | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage colle | ||
| CVE-2026-21435 | — | < 1.31.14.2.1-r8 | 1.31.14.2.1-r8 | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CON | ||
| CVE-2026-21434 | — | < 1.31.14.2.1-r8 | 1.31.14.2.1-r8 | Feb 12, 2026 | webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message. | ||
| CVE-2026-26014 | — | < 1.31.14.2.2-r0 | 1.31.14.2.2-r0 | Feb 11, 2026 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging th | ||
| CVE-2025-68121 | Cri | 10.0 | < 1.31.14.2.1-r7 | 1.31.14.2.1-r7 | Feb 5, 2026 | During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and | |
| CVE-2025-58190 | — | < 1.31.14.2.1-r8 | 1.31.14.2.1-r8 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | ||
| CVE-2025-47911 | — | < 1.31.14.2.1-r8 | 1.31.14.2.1-r8 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | ||
| CVE-2025-61732 | — | < 1.31.14.2.1-r7 | 1.31.14.2.1-r7 | Feb 5, 2026 | A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. | ||
| CVE-2025-61728 | — | < 1.31.14.2.1-r7 | 1.31.14.2.1-r7 | Jan 28, 2026 | archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive. | ||
| CVE-2025-61726 | — | < 1.31.14.2.1-r7 | 1.31.14.2.1-r7 | Jan 28, 2026 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a la | ||
| CVE-2025-61730 | — | < 1.31.14.2.1-r7 | 1.31.14.2.1-r7 | Jan 28, 2026 | During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor i |
- affected < 1.31.14.2.2-r1fixed 1.31.14.2.2-r1
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls
- affected < 1.31.14.2.2-r1fixed 1.31.14.2.2-r1
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
- affected < 1.31.14.2.2-r1fixed 1.31.14.2.2-r1
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
- affected < 1.31.14.2.2-r1fixed 1.31.14.2.2-r1
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
- CVE-2026-33817Apr 6, 2026affected < 1.31.14.2.2-r0fixed 1.31.14.2.2-r0
Rejected reason: CVE confirmed to be a false positive
- affected < 1.31.14.2.2-r0fixed 1.31.14.2.2-r0
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escap
- affected < 1.31.14.2.2-r0fixed 1.31.14.2.2-r0
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary
- affected < 1.31.14.2.2-r0fixed 1.31.14.2.2-r0
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- affected < 1.31.14.2.1-r8fixed 1.31.14.2.1-r8
filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If (*Poin
- CVE-2026-21438Feb 12, 2026affected < 1.31.14.2.1-r8fixed 1.31.14.2.1-r8
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, preventing garbage colle
- CVE-2026-21435Feb 12, 2026affected < 1.31.14.2.1-r8fixed 1.31.14.2.1-r8
webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of service in webtransport-go by preventing or indefinitely delaying WebTransport session closure. A malicious peer can withhold QUIC flow control credit on the CON
- CVE-2026-21434Feb 12, 2026affected < 1.31.14.2.1-r8fixed 1.31.14.2.1-r8
webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive memory consumption in webtransport-go's session implementation by sending a WT_CLOSE_SESSION capsule containing an excessively large Application Error Message.
- CVE-2026-26014Feb 11, 2026affected < 1.31.14.2.2-r0fixed 1.31.14.2.2-r0
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging th
- affected < 1.31.14.2.1-r7fixed 1.31.14.2.1-r7
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and
- CVE-2025-58190Feb 5, 2026affected < 1.31.14.2.1-r8fixed 1.31.14.2.1-r8
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- CVE-2025-47911Feb 5, 2026affected < 1.31.14.2.1-r8fixed 1.31.14.2.1-r8
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- CVE-2025-61732Feb 5, 2026affected < 1.31.14.2.1-r7fixed 1.31.14.2.1-r7
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
- CVE-2025-61728Jan 28, 2026affected < 1.31.14.2.1-r7fixed 1.31.14.2.1-r7
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
- CVE-2025-61726Jan 28, 2026affected < 1.31.14.2.1-r7fixed 1.31.14.2.1-r7
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a la
- CVE-2025-61730Jan 28, 2026affected < 1.31.14.2.1-r7fixed 1.31.14.2.1-r7
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor i
Page 2 of 3