Most recent entries from all

Withdrawn: CLEANSTART-2025-CN65903 — Security fixes for GHSA-6v2p-p543-phr9, GHSA-qxp5-gwg8-xv66, GHSA-vvgc-356p-c3xw applied in versions: 1.5.0-r0, 1.7.0-r0

2026-09-28T14:51:50.090202+00:00

Withdrawn by the publisher.

Affected: CleanStart: vault-k8s-fips

Multiple security vulnerabilities affect the vault-k8s-fips package. These issues are resolved in later releases. See references for individual GHSA details.

GHSA-qxp5-gwg8-xv66 — HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

2026-09-28T14:51:50.090284+00:00

Affected: Go: golang.org/x/net

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.