TI-2025-16743 CVE-2025-22871 · GHSA-g9pc-8g42-g6vq
Request smuggling due to acceptance of invalid chunked data in net/http
Priority MEDIUM 49
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.
RHSA-2025:22683
multicluster engine for Kubernetes v2.7.7 security update
Released 2025-12-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.7 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +8
Fixes 4 records
TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p
Uncontrolled Resource Consumption in promhttp
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
TI-2024-16303 CVE-2024-24786 · GHSA-8r3f-844c-mc37
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
Priority MEDIUM 41
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
TI-2025-06557 CVE-2025-7195 · GHSA-856v-8qm2-9wjv
Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
Priority LOW 28
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID.