Security information#

Updated the following middleware component versions to enhance security and performance in MSR:

golang 1.25.13 (from 1.25.11)
RethinkDB 2.3.7-mirantis-1.2.10 (from 2.3.7-mirantis-1.2.9)
dompurify 2.5.9 (from 2.0.11)
[ENGDTR-5107] js-yaml 4.3.2 (from 4.0.0) and 3.15.2 (from 3.13.1)
[ENGDTR-5066] qs 6.16.0 (from 6.5.0)
decode-uri-component 0.2.2 (from 0.2.0)
dotty 0.1.2 (from 0.0.2)

Resolved CVEs#

CVE	Image mitigated	Problem details from upstream
CVE-2026-8925	`msr/dtr-jobrunner` `msr/dtr-rethink`	The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it `free()` the same pointer twice.
CVE-2026-86144	`msr/dtr-jobrunner` `msr/dtr-postgres`	In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
CVE-2026-86143	`msr/dtr-jobrunner` `msr/dtr-postgres`	In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
CVE-2026-86142	`msr/dtr-jobrunner` `msr/dtr-postgres`	In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
CVE-2026-86140	`msr/dtr-jobrunner` `msr/dtr-postgres`	In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
CVE-2026-86139	`msr/dtr-jobrunner` `msr/dtr-postgres`	In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
CVE-2026-86138	`msr/dtr-jobrunner` `msr/dtr-postgres`	In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
CVE-2026-84445	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.
CVE-2026-84304	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
CVE-2026-80256	`msr/dtr-jobrunner` `msr/dtr-rethink`	A vulnerability in the wcurl script of the curl project (reported via HackerOne) allows an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user’s filesystem permissions and the target path not already existing. The root cause is in the get_url_filename() function, which protected percent-encoded characters but left a literal backslash unchanged before it was used as the automatic output filename. The issue was reproduced on Windows 10 build 19045 using the official curl 8.21.0_7 x64 archive. No patch version or workaround is specified in the provided documents, and the SUSE entry currently lists the description as unknown. No in-the-wild exploitation details are provided beyond the HackerOne report.
CVE-2026-80229	`msr/dtr-jobrunner` `msr/dtr-rethink`	When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.
CVE-2026-78662	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
CVE-2026-76957	`msr/dtr-jobrunner`	libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-76956	`msr/dtr-jobrunner`	In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
CVE-2026-76641	`msr/dtr-jobrunner`	Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
CVE-2026-71491	`msr/dtr-jobrunner`	sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
CVE-2026-6846	`msr/dtr-jobrunner`	A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable.
CVE-2026-66046	`msr/dtr-jobrunner`	Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
CVE-2026-63076	`msr/dtr-jobrunner` `msr/dtr-postgres`	OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer.
CVE-2026-63075	`msr/dtr-jobrunner` `msr/dtr-postgres`	When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection.
CVE-2026-63074	`msr/dtr-jobrunner` `msr/dtr-postgres`	The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth.
CVE-2026-63073	`msr/dtr-jobrunner` `msr/dtr-postgres`	OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`.
CVE-2026-63072	`msr/dtr-jobrunner` `msr/dtr-postgres`	OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write.
CVE-2026-59894	`msr/dtr-jobrunner`	sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.
CVE-2026-59893	`msr/dtr-jobrunner`	sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.
CVE-2026-56862	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
CVE-2026-56860	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
CVE-2026-56859	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
CVE-2026-56855	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
CVE-2026-56854	`msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-rethink`	The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
CVE-2026-56853	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
CVE-2026-56852	`msr/dtr-notary-server` `msr/dtr-notary-signer`	A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
CVE-2026-54874	`msr/dtr-jobrunner` `msr/dtr-postgres`	Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires.
CVE-2026-54284	`msr/dtr-jobrunner`	sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.
CVE-2026-53492	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
CVE-2026-50195	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
CVE-2026-49839	`msr/dtr-rethink`	jq is a command-line JSON processor. Prior to 1.8.2,`jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too long"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.
CVE-2026-46600	`msr/dtr-notary-server` `msr/dtr-notary-signer`	Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
CVE-2026-42504	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
CVE-2026-42306	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.
CVE-2026-41567	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
CVE-2026-40164	`msr/dtr-rethink`	jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.
CVE-2026-39822	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
CVE-2026-39821	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
CVE-2026-34040	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
CVE-2026-33997	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.
CVE-2026-33818	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
CVE-2026-32316	`msr/dtr-rethink`	jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.
CVE-2026-27145	`msr/dtr` `msr/dtr-api` `msr/dtr-content-cache` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
CVE-2026-19931	`msr/dtr-jobrunner` `msr/dtr-rethink`	A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection.
CVE-2026-18924	`msr/dtr-jobrunner` `msr/dtr-rethink`	A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.
CVE-2026-18798	`msr/dtr-jobrunner` `msr/dtr-postgres`	QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet.
CVE-2026-14457	`msr/dtr-jobrunner` `msr/dtr-postgres`	In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension.
CVE-2026-14456	`msr/dtr-jobrunner` `msr/dtr-postgres`	When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit.
CVE-2026-11564	`msr/dtr-jobrunner` `msr/dtr-rethink`	libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.
CVE-2025-69652	`msr/dtr-jobrunner`	GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.
CVE-2025-69650	`msr/dtr-jobrunner`	GNU Binutils thru 2.46 readelf contains a double free vulnerability when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array. As a result, process_got_section_contents() may pass an uninitialized r_symbol pointer to free(), leading to a double free and terminating the program with SIGABRT. No evidence of exploitable memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.
CVE-2025-69649	`msr/dtr-jobrunner`	GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
CVE-2025-65637	`msr/dtr-rethink`	A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
CVE-2025-55199	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.
CVE-2025-55198	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.
CVE-2025-53547	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.
CVE-2025-32387	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3.
CVE-2025-32386	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issue has been resolved in Helm v3.17.3.
CVE-2025-15558	`msr/dtr` `msr/dtr-api` `msr/dtr-garant` `msr/dtr-jobrunner` `msr/dtr-nginx` `msr/dtr-notary-server` `msr/dtr-notary-signer` `msr/dtr-postgres` `msr/dtr-registry` `msr/dtr-rethink`	Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user. This issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager package, such as Docker Compose. This issue does not impact non-Windows binaries, and projects not using the plugin-manager code.