alloy vulnerabilities (openSUSE)
85 vulnerabilities.
alloyopenSUSEOpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure3.8 LowalloyopenSUSEOpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size5.9 MediumalloyopenSUSEOpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU5.9 MediumalloyopenSUSEOpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads7.5 HighalloyopenSUSEOpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages6.5 MediumalloyopenSUSEgo-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion6.5 MediumalloyopenSUSEInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net7.5 HighalloyopenSUSEApache Thrift: C++ JSON OOB read6.5 MediumalloyopenSUSEApache Thrift: c_glib dispatch stack overflow5.3 MediumalloyopenSUSEApache Thrift: Go TFramedTransport uint32 overflow7.5 HighalloyopenSUSEpgx: SQL Injection via placeholder confusion with dollar quoted string literals2.3 LowalloyopenSUSEgo-git Credential leak via cross-host redirect in smart HTTP transport4.7 MediumalloyopenSUSEDenial of service in the event stream header decoder in AWS SDK for Go v28.2 HighalloyopenSUSEGo JOSE affect by a panic in JWE decryption7.5 HighalloyopenSUSEyaml is vulnerable to Stack Overflow via deeply nested YAML collections4.3 MediumalloyopenSUSEDuplicate Advisory: pgproto3: Negative field length panics in DataRow.Decode7.5 HighalloyopenSUSEgRPC-Go has an authorization bypass via missing leading slash in :path9.1 CriticalalloyopenSUSEIncorrect calculation in CIRCL secp384r1 CombinedMult2.9 LowalloyopenSUSEfilippo.io/edwards25519 MultiScalarMult function produces invalid results or undefined behavior if receiver is not the identity1.7 LowalloyopenSUSEHeap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak6.9 MediumalloyopenSUSEgo-git improperly verifies data integrity values for .idx and .pack files4.3 MediumalloyopenSUSEExpr has Denial of Service via Unbounded Recursion in Builtin Functions7.5 HighalloyopenSUSEPotential denial of service in golang.org/x/crypto/ssh/agent7.5 HighalloyopenSUSErunc: LSM labels can be bypassed with malicious config using dummy procfs files7.3 HighalloyopenSUSEcontainer escape due to /dev/console mount and related races8.4 HighalloyopenSUSErunc container escape via "masked path" abuse due to mount race conditions7.3 HighalloyopenSUSEInfinite parsing loop in golang.org/x/net5.3 MediumalloyopenSUSEQuadratic parsing complexity in golang.org/x/net/html5.3 MediumalloyopenSUSEgithub.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives5.3 MediumalloyopenSUSEGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure5.3 MediumalloyopenSUSEGo Snowflake Driver has race condition when checking access to Easy Logging configuration file3.3 LowalloyopenSUSEIncorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net6.5 MediumalloyopenSUSEGrafana Alloy on Windows Unquoted service path7.3 HighalloyopenSUSEOpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC8.2 HighalloyopenSUSEInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 Critical