4.13.1#
This section contains the release notes for MSR 4.13.1, including addressed issues, component versions, known issues, and resolved Common Vulnerabilities and Exposures (CVEs).
Addressed Issues#
MSR 4.13.1 delivers bug fixes and component updates. For details, see Security Information.
Note
For the complete list of upstream changes and pull requests, refer to the Harbor 2.13.1 Release Notes.
Component Versions#
| Component | Version |
|---|---|
| Harbor | 2.13.1 |
| Golang | 1.23.10 |
| Distribution | v2.8.3-23-g0c62ec3e |
| PostgreSQL | 15.13 |
| Redis | 7.2.6 |
| Trivy scanner | 0.62.1 |
| Trivy adapter | 0.33.1 |
| NGINX | 1.26.2 |
Known Issues#
This section describes the MSR 4.13.1 known issues with available workarounds, along with current product limitations.
Configuration Audit Log Written to Audit Log on Configuration Change#
Severity: Medium
MSR writes the configuration payload (ldap_search_password and
oidc_client_secret) to the audit log when the configuration changes.
As a workaround, disable audit logging in the MSR system settings.
Security Information#
The following table summarizes the Common Vulnerabilities and Exposures (CVEs) that MSR 4.13.1 resolves in the MSR images. The severity ratings come from the National Vulnerability Database (NVD) and reflect the NVD data as of November 6, 2026.
| Severity | CVEs |
|---|---|
| Critical | 1 |
| High | 4 |
| Medium | 6 |
| Total | 11 |
MSR 4.13.1 resolved CVEs detailed
| CVE | Severity | Problem details from upstream |
|---|---|---|
| CVE-2025-22871 | Critical | The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if used with a server that incorrectly accepts bare LFs in chunk extensions. |
| CVE-2025-47291 | High | In containerd 2.0.1–2.0.4, usernamespaced containers may not be placed under Kubernetes’ cgroup hierarchy, bypassing limits and enabling DoS. Fixed in containerd 2.0.5+ and 2.1.0+. |
| CVE-2025-47273 | High | setuptools prior to 78.1.1 contained a path traversal vulnerability in PackageIndex that could allow arbitrary file writes or remote code execution. Fixed in 78.1.1. |
| CVE-2025-46569 | High | Open Policy Agent (OPA) prior to v1.4.0 could allow Rego code injection through crafted HTTP Data API paths, potentially leading to oracle attacks, policy misdirection, or DoS. Fixed in v1.4.0. |
| CVE-2025-22868 | High | An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. |
| CVE-2025-32387 | Medium | Deeply nested JSON Schema references in Helm charts can cause stack overflow during parsing. Fixed in Helm v3.17.3. |
| CVE-2025-32386 | Medium | Helm chart archives can be crafted to expand disproportionately when decompressed, exhausting system memory. Fixed in Helm v3.17.3. |
| CVE-2025-24358 | Medium | gorilla/csrf prior to 1.7.2 did not properly validate the Origin header, allowing CSRF attacks when TLS detection failed. Fixed in v1.7.2. |
| CVE-2025-22872 | Medium | The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. This can cause incorrect DOM structure in foreign content such as <math> or <svg>. |
| CVE-2025-22870 | Medium | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to *.example.com, a request to [::1%25.example.com]:80 will incorrectly match and not be proxied. |
| CVE-2024-45338 | Medium | An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing and potential denial of service. |
Note
MSR enables you to download the Software Bill of Materials (SBOM) of any MSR 4.13.1 image to confirm the resolved CVEs by scanning its packages with your own security tools. For details, see Retrieving SBOMs for MSR Images.