4.13.2#
This section contains the release notes for MSR 4.13.2, including addressed issues, component versions, known issues, and resolved Common Vulnerabilities and Exposures (CVEs).
Addressed Issues#
[MSRH-292] Fixed an issue wherein link previews displayed Harbor branding instead of Mirantis Secure Registry branding.
Note
For the complete list of upstream changes and pull requests, refer to the Harbor 2.13.2 Release Notes.
Component Versions#
| Component | Version |
|---|---|
| Harbor | 2.13.2 |
| Golang | 1.24.6 |
| Distribution | v2.8.3-23-g0c62ec3e |
| PostgreSQL | 15.14 |
| Redis | 7.2.6 |
| Trivy scanner | 0.64.1 |
| Trivy adapter | 0.33.2 |
| NGINX | 1.26.3 |
Known Issues#
This section describes the MSR 4.13.2 known issues with available workarounds, along with current product limitations.
Configuration Audit Log Written to Audit Log on Configuration Change#
Severity: Medium
MSR writes the configuration payload (ldap_search_password and
oidc_client_secret) to the audit log when the configuration changes.
As a workaround, disable audit logging in the MSR system settings.
Security Information#
The following table summarizes the Common Vulnerabilities and Exposures (CVEs) that MSR 4.13.2 resolves in the MSR images. The severity ratings come from the National Vulnerability Database (NVD) and reflect the NVD data as of November 6, 2026.
| Severity | CVEs |
|---|---|
| Critical | 3 |
| High | 8 |
| Medium | 6 |
| Total | 17 |
MSR 4.13.2 resolved CVEs detailed
| CVE | Severity | Problem details from upstream |
|---|---|---|
| CVE-2025-49796 | Critical | Certain sch:name elements in XML can trigger memory corruption in libxml2, leading to potential crashes or undefined behavior. |
| CVE-2025-49794 | Critical | A use-after-free vulnerability in libxml2 occurs when parsing XPath elements in XML Schematron documents, potentially causing crashes or undefined behavior. |
| CVE-2024-3596 | Critical | RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) using a chosen-prefix collision attack against the MD5 Response Authenticator signature. |
| CVE-2025-53547 | High | Helm prior to v3.18.4 could execute arbitrary code if a symlinked Chart.lock file points to an executable script. Fixed in v3.18.4. |
| CVE-2025-49795 | High | A NULL pointer dereference vulnerability in libxml2’s XPath processing allows crafted XML inputs to cause denial of service. |
| CVE-2025-47907 | High | Cancelling a query during a call to Scan() could cause race conditions and incorrect results when multiple queries run concurrently. |
| CVE-2025-32990 | High | A heap-buffer-overflow (off-by-one) in GnuTLS’s certtool template parsing logic can result in memory corruption or denial of service. |
| CVE-2025-32988 | High | A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of SAN entries containing an otherName. Triggering this issue via public GnuTLS APIs can lead to denial of service or memory corruption. |
| CVE-2025-22874 | High | Calling Verify with VerifyOptions.KeyUsages containing ExtKeyUsageAny unintentionally disabled policy validation for certain certificate chains. |
| CVE-2025-6021 | High | A stack-based buffer overflow in libxml2’s xmlBuildQName function due to integer overflow may cause denial of service or memory corruption. |
| CVE-2025-5222 | High | A stack buffer overflow in ICU’s genrb binary (in the SRBRoot::addTag function) can cause memory corruption and local code execution. |
| CVE-2025-55199 | Medium | Helm prior to v3.18.5 could be forced into an out-of-memory condition by crafted JSON Schema references (e.g., $ref to /dev/zero). Fixed in v3.18.5. |
| CVE-2025-55198 | Medium | Improper validation in Helm prior to v3.18.5 could cause a panic when parsing malformed YAML files. Fixed in v3.18.5. |
| CVE-2025-32989 | Medium | A heap-buffer-overread in GnuTLS affects how Certificate Transparency SCT extensions are handled, potentially exposing confidential data when verifying certain malformed certificates. |
| CVE-2025-6395 | Medium | A NULL pointer dereference flaw in GnuTLS’s _gnutls_figure_common_ciphersuite() may lead to crashes. |
| CVE-2025-4673 | Medium | Proxy-Authorization and Proxy-Authenticate headers could persist across cross-origin redirects, leaking sensitive information. |
| CVE-2025-0913 | Medium | On Windows, os.OpenFile(path, os.O_CREATE|O_EXCL) could create files through dangling symlinks. The function now returns an error when targeting a symlink. |
Note
MSR enables you to download the Software Bill of Materials (SBOM) of any MSR 4.13.2 image to confirm the resolved CVEs by scanning its packages with your own security tools. For details, see Retrieving SBOMs for MSR Images.