chainguard/teleport-operator-fips-18

Vulnerabilities (58)

• CVE-2026-32283HigApr 8, 2026
  affected < 18.7.2-r6fixed 18.7.2-r6

  If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

• CVE-2026-32282MedApr 8, 2026
  affected < 0fixed 0

  On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which R

• CVE-2026-32281HigApr 8, 2026
  affected < 18.7.2-r6fixed 18.7.2-r6

  Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root C

• CVE-2026-32280HigApr 8, 2026
  affected < 18.7.2-r6fixed 18.7.2-r6

  During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls

• CVE-2026-27144HigApr 8, 2026
  affected < 18.7.2-r6fixed 18.7.2-r6

  The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

• CVE-2026-27143CriApr 8, 2026
  affected < 18.7.2-r6fixed 18.7.2-r6

  Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

• CVE-2026-27140HigApr 8, 2026
  affected < 18.7.2-r6fixed 18.7.2-r6

  SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

• CVE-2026-34986HigApr 6, 2026
  affected < 18.7.2-r5fixed 18.7.2-r5

  Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JW

• CVE-2026-32286HigMar 26, 2026
  affected < 0fixed 0

  The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

• CVE-2026-33487HigMar 26, 2026
  affected < 18.7.2-r2fixed 18.7.2-r2

  goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element's ID. In Go versions before 1.22, or when `go.mo

• CVE-2026-33186CriMar 20, 2026
  affected < 18.7.2-r1fixed 18.7.2-r1

  gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omi

• CVE-2026-27141HigFeb 26, 2026
  affected < 18.7.1-r3fixed 18.7.1-r3

  Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

• CVE-2026-24051HigFeb 2, 2026
  affected < 18.7.1-r2fixed 18.7.1-r2

  OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system comman

• CVE-2026-24686Jan 27, 2026
  affected < 18.7.5-r0fixed 18.7.5-r0

  go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.

• CVE-2026-24137MedJan 23, 2026
  affected < 18.7.1-r1fixed 18.7.1-r1

  sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target na

• CVE-2026-23992Jan 22, 2026
  affected < 18.7.5-r0fixed 18.7.5-r0

  go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This

• CVE-2026-23991Jan 22, 2026
  affected < 18.7.5-r0fixed 18.7.5-r0

  go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing,

• CVE-2025-66564Dec 4, 2025
  affected < 18.6.1-r1fixed 18.6.1-r1

  Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits t