Most recent entries from cleanstart

CLEANSTART-2026-ZV78301 — SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the c…

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

Security vulnerability affects the consul package. SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

CLEANSTART-2026-ZL19560 — Security fix for ghsa-9h8m-3fm2-qjrq applied in: consul 1.21.5-r0, cosign 3.0.5-r0

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul, CleanStart: cosign

ghsa-9h8m-3fm2-qjrq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

CLEANSTART-2026-YZ71204 — authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory grow…

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

Security vulnerability affects the consul package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users.

CLEANSTART-2026-YM37209 — Security fix for ghsa-4f99-4q7p-p3gh applied in: consul 1.20.6-r0, consul 1.21.5-r0

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

ghsa-4f99-4q7p-p3gh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

CLEANSTART-2026-YF33963 — Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details.

CLEANSTART-2026-YE69312 — Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbit…

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details.

CLEANSTART-2026-XZ73370 — Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details.

CLEANSTART-2026-TZ02456 — denial-of-service vulnerability exists in github

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

CVE-2025-65637 affects multiple packages. A denial-of-service vulnerability exists in github. See references for individual vulnerability details.

CLEANSTART-2026-TS90060 — Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

Security vulnerability affects the consul package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

CLEANSTART-2026-TG08354 — html

2026-10-01T12:15:40+00:00

Affected: CleanStart: consul

Security vulnerability affects the consul package. The html.