apk package
chainguard/twt
pkg:apk/chainguard/twt
Vulnerabilities (79)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-56862 | Hig | 7.5 | < 0.0.50-r5 | 0.0.50-r5 | Aug 13, 2026 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef | |
| CVE-2026-56860 | Med | 5.9 | < 0.0.50-r5 | 0.0.50-r5 | Aug 13, 2026 | Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-b | |
| CVE-2026-56859 | Hig | 7.5 | < 0.0.50-r5 | 0.0.50-r5 | Aug 13, 2026 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. | |
| CVE-2026-56858 | Med | 6.1 | < 0.0.50-r5 | 0.0.50-r5 | Aug 13, 2026 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. | |
| CVE-2026-56853 | Hig | 7.5 | < 0 | 0 | Aug 13, 2026 | When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. | |
| CVE-2026-33818 | Hig | 7.5 | < 0.0.50-r5 | 0.0.50-r5 | Aug 13, 2026 | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. | |
| CVE-2026-56852 | Hig | 7.5 | < 0.0.50-r4 | 0.0.50-r4 | Jul 21, 2026 | A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. | |
| CVE-2026-46600 | Hig | 7.5 | < 0 | 0 | Jul 21, 2026 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. | |
| CVE-2026-50163 | Hig | 7.1 | < 0 | 0 | Jul 17, 2026 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd | |
| CVE-2026-50162 | Med | — | < 0.0.50-r1 | 0.0.50-r1 | Jul 17, 2026 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title th | |
| CVE-2026-50151 | Hig | 7.5 | < 0.0.50-r1 | 0.0.50-r1 | Jul 17, 2026 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST reques | |
| CVE-2026-48978 | Low | — | < 0.0.50-r1 | 0.0.50-r1 | Jul 17, 2026 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such a | |
| CVE-2026-53492 | Cri | 9.6 | < 0.0.50-r0 | 0.0.50-r0 | Jul 1, 2026 | containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a conta | |
| CVE-2026-53489 | Med | 6.5 | < 0.0.50-r0 | 0.0.50-r0 | Jul 1, 2026 | containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl l | |
| CVE-2026-50195 | Cri | 9.9 | < 0.0.50-r0 | 0.0.50-r0 | Jul 1, 2026 | containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions | |
| CVE-2026-47262 | Med | 5.5 | < 0.0.49-r2 | 0.0.49-r2 | Jul 1, 2026 | containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occ | |
| CVE-2026-46680 | Hig | 7.8 | < 0.0.48-r1 | 0.0.48-r1 | Jul 1, 2026 | containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted im | |
| CVE-2026-53488 | Hig | 8.8 | < 0.0.49-r2 | 0.0.49-r2 | Jul 1, 2026 | containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary comman | |
| CVE-2026-42306 | Hig | 7.2 | < 0 | 0 | Jun 12, 2026 | Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount targe | |
| CVE-2026-41568 | Med | 6.1 | < 0 | 0 | Jun 12, 2026 | Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or direc |
- affected < 0.0.50-r5fixed 0.0.50-r5
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indef
- affected < 0.0.50-r5fixed 0.0.50-r5
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-b
- affected < 0.0.50-r5fixed 0.0.50-r5
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
- affected < 0.0.50-r5fixed 0.0.50-r5
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
- affected < 0fixed 0
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
- affected < 0.0.50-r5fixed 0.0.50-r5
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
- affected < 0.0.50-r4fixed 0.0.50-r4
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
- affected < 0fixed 0
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
- affected < 0fixed 0
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd
- affected < 0.0.50-r1fixed 0.0.50-r1
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title th
- affected < 0.0.50-r1fixed 0.0.50-r1
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST reques
- affected < 0.0.50-r1fixed 0.0.50-r1
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such a
- affected < 0.0.50-r0fixed 0.0.50-r0
containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a conta
- affected < 0.0.50-r0fixed 0.0.50-r0
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl l
- affected < 0.0.50-r0fixed 0.0.50-r0
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions
- affected < 0.0.49-r2fixed 0.0.49-r2
containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occ
- affected < 0.0.48-r1fixed 0.0.48-r1
containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted im
- affected < 0.0.49-r2fixed 0.0.49-r2
containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary comman
- affected < 0fixed 0
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount targe
- affected < 0fixed 0
Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or direc
Page 1 of 4