Most recent entries from all

Withdrawn: CLEANSTART-2026-KI12594 — Security fixes in cluster-proportional-autoscaler 1.7.1-r0

Withdrawn by the publisher.

Affected: CleanStart: cluster-proportional-autoscaler

Package cluster-proportional-autoscaler version 1.7.1-r0 fixes 7 vulnerabilities: CVE-2021-3121, CVE-2022-3064, CVE-2020-8559, CVE-2019-11254, CVE-2019-11250...

EUVD-2026-228810

fkie_cve-2021-4235

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

GHSA-r88r-gmrh-7j83 — YAML Go package vulnerable to denial of service

Affected: Go: gopkg.in/yaml.v2, Go: github.com/go-yaml/yaml

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

gsd-2021-4235

msrc_CVE-2021-4235 — Denial of service in gopkg.in/yaml.v2

msrc_CVE-2021-4235

RHSA-2022:7398 — Red Hat Security Advisory: OpenShift Container Platform 4.12.0 packages and security update

go-yaml: Denial of Service in go-yaml golang: net/http: improper sanitization of Transfer-Encoding header golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters cri-o: incorrect handling of the supplementary groups python-scciclient: missing server certificate verification kubernetes: Unauthorized read of Custom Resources kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) OpenShift: Missing HTTP Strict Transport Security cri-o: Security regression of CVE-2022-27652 golang: net/http: handle server errors after sending GOAWAY golang: compress/gzip: stack exhaustion in Reader.Read golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service golang: net/url: JoinPath does not strip relative path components in all circumstances golang: regexp/syntax: limit memory used by parsing regexps

UBUNTU-CVE-2021-4235

Affected: Ubuntu:Pro:16.04:LTS: golang-yaml.v2, Ubuntu:Pro:18.04:LTS: golang-yaml.v2, Ubuntu:Pro:18.04:LTS: singularity-container, Ubuntu:18.04:LTS: webhook, Ubuntu:20.04:LTS: golang-yaml.v2, Ubuntu:20.04:LTS: golang-github-coreos-discovery-etcd-io, Ubuntu:20.04:LTS: webhook, Ubuntu:22.04:LTS: golang-github-coreos-discovery-etcd-io, Ubuntu:22.04:LTS: webhook, Ubuntu:24.04:LTS: golang-github-coreos-discovery-etcd-io and 8 more

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.

WID-SEC-W-2023-0111 — Red Hat OpenShift: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.