{ "vulnerabilities": [ { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/traefik@v3.7.5", "zlib/zlib@1.3.2-r0" ], "upgradePath": [ false, "zlib/zlib@1.3.2-r1" ], "isUpgradable": true, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/traefik@v3.7.5", "apk-tools/apk-tools@3.0.6-r0", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/traefik@v3.7.5", "apk-tools/apk-tools@3.0.6-r0", "apk-tools/libapk@3.0.6-r0", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1" } ], "ok": false, "dependencyCount": 18, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "apk", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Alpine Linux v3.23" } }, "summary": "3 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 1, "projectName": "docker-image|docker.io/traefik", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/traefik:v3.7.5/traefik", "applications": [ { "vulnerabilities": [ { "id": "SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-19256953", "title": "Authorization Bypass Through User-Controlled Key", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "Ali Firas" ], "semver": { "vulnerable": [ "<1.70.0" ], "hashesRange": [ "=1.83.0 <1.83.2" ], "hashesRange": [ "=v1.83.0 =1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6090)\n- [Go Code Review](https://go.dev/cl/804261)\n- [Go Issue](https://go.dev/issue/80528)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44650", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6090" ], "CVE": [ "CVE-2026-56862" ], "CWE": [ "CWE-400" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2026-08-16T13:30:25.367479Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:25.586356Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.946419Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/traefik/traefik/v3@*", "stdlib@1.25.11" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.25.11" }, { "id": "SNYK-GOLANG-STDENCODINGASN1-18858463", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.\n## Remediation\nUpgrade `std/encoding/asn1` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5972)\n- [Go Code Review](https://go.dev/cl/814980)\n- [Go Issue](https://go.dev/issue/80405)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5972" ], "CVE": [ "CVE-2026-33818" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/asn1", "proprietary": false, "creationTime": "2026-08-16T13:31:49.649800Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:31:49.810065Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.337609Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/traefik/traefik/v3@*", "stdlib@1.25.11" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.25.11" }, { "id": "SNYK-GOLANG-STDENCODINGXML-18858455", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6088)\n- [Go Code Review](https://go.dev/cl/803320)\n- [Go Issue](https://go.dev/issue/80481)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6088" ], "CVE": [ "CVE-2026-56859" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/xml", "proprietary": false, "creationTime": "2026-08-16T13:30:41.577448Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:41.759190Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.639999Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/traefik/traefik/v3@*", "stdlib@1.25.11" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.25.11" }, { "id": "SNYK-GOLANG-STDNETHTTP-18858429", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/http` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6089)\n- [Go Code Review](https://go.dev/cl/795540)\n- [Go Issue](https://go.dev/issue/80205)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6089" ], "CVE": [ "CVE-2026-56853" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-08-16T13:28:12.349185Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:12.649447Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:46.191702Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/traefik/traefik/v3@*", "stdlib@1.25.11" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.25.11" }, { "id": "SNYK-GOLANG-STDNETURL-18858438", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/url` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6218)\n- [Go Code Review](https://go.dev/cl/803681)\n- [Go Issue](https://go.dev/issue/80494)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.43587", "probability": "0.00550", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6218" ], "CVE": [ "CVE-2026-56860" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/url", "proprietary": false, "creationTime": "2026-08-16T13:28:43.607348Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:43.780899Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.599966Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/traefik/traefik/v3@*", "stdlib@1.25.11" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.25.11" }, { "id": "SNYK-GOLANG-STDOS-17905377", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ "<1.25.12", ">=1.26.0-0 <1.26.5", ">=1.27.0-0 <1.27.0-rc.2" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.\n## Remediation\nUpgrade `std/os` to version 1.25.12, 1.26.5, 1.27.0-rc.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4970)\n- [Go Code Review](https://go.dev/cl/797880)\n- [Go Issue](https://go.dev/issue/79005)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc)\n", "epssDetails": { "percentile": "0.12762", "probability": "0.00232", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4970" ], "CVE": [ "CVE-2026-39822" ], "CWE": [ "CWE-59" ] }, "packageName": "std/os", "proprietary": false, "creationTime": "2026-07-09T11:52:28.124727Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-07T21:34:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-07-09T11:52:28.309070Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:23.087760Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/traefik/traefik/v3@*", "stdlib@1.25.11" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.25.11" } ], "ok": false, "dependencyCount": 1951, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "16 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 16, "targetFile": "/usr/local/bin/traefik", "projectName": "github.com/traefik/traefik/v3", "displayTargetFile": "/usr/local/bin/traefik", "hasUnknownVersions": false, "path": "docker.io/traefik:v3.7.5/traefik/traefik/v3" } ] }