# Snyk test report

June 14th 2026, 1:00:42 am (UTC+00:00)

Scanned the following paths:

- quay.io/argoproj/argocd:v3.4.3/argoproj/argocd/Dockerfile (deb)
- quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3//usr/local/bin/argocd (gomodules)
- quay.io/argoproj/argocd:v3.4.3//usr/local/bin/git-lfs (gomodules)
- quay.io/argoproj/argocd:v3.4.3//usr/local/bin/kustomize (gomodules)
- quay.io/argoproj/argocd:v3.4.3/helm/v3//usr/local/bin/helm (gomodules)

118 known vulnerabilities
476 vulnerable dependency paths
2363 dependencies

## Improper Authentication

critical severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/net/idna
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/idna@v0.52.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/idna@v0.52.0
- Introduced through: go-distribution@command-line-arguments@* › golang.org/x/net/idna@v0.38.0
- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/idna@v0.47.0

## Overview

Affected versions of this package are vulnerable to Improper Authentication via the `ToASCII` and `ToUnicode` functions. An attacker can bypass hostname validation by submitting Punycode-encoded labels that decode to ASCII-only labels, potentially leading to privilege escalation in applications that rely on these functions for security checks.

Note: The fix depends on the Go toolchain in use having Unicode version 16 or later, which is planned for the 1.27 release.

## Remediation

Upgrade `golang.org/x/net/idna` to version 0.54.0 or higher.

## References

- GitHub Commit
- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## CVE-2026-45447

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution.

When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition.

In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution.

Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45447
- https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
- https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8
- https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
- https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c
- https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
- https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8
- https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54
- https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c
- https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e

More about this vulnerability

## Infinite loop

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/net/http2
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/http2@v0.52.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/http2@v0.52.0
- Introduced through: go-distribution@command-line-arguments@* › golang.org/x/net/http2@v0.38.0
- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/http2@v0.47.0

## Overview

golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

Affected versions of this package are vulnerable to Infinite loop.
Go Vulnerability Report:

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a `SETTINGS_MAX_FRAME_SIZE` with a value of 0.

## Remediation

Upgrade `golang.org/x/net/http2` to version 0.53.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Improper Check for Certificate Revocation

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh/knownhosts
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh/knownhosts@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh/knownhosts@v0.49.0

## Overview

Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the `SignatureKey` verification process. An attacker can bypass revocation enforcement by presenting a certificate with a revoked `SignatureKey`, potentially allowing unauthorized access or trust to be established.

## Remediation

Upgrade `golang.org/x/crypto/ssh/knownhosts` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Incorrect Type Conversion or Cast

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh/agent
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh/agent@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh/agent@v0.49.0

## Overview

Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast due to the improper handling of crafted input data in the `ed25519.PrivateKey` component. An attacker can cause the client to panic by supplying malformed wire bytes.

## Remediation

Upgrade `golang.org/x/crypto/ssh/agent` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Missing Release of Resource after Effective Lifetime

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the repeated opening of channels by an authenticated SSH client that are subsequently rejected by the server. An attacker can cause unbounded memory growth and crash the server process by continuously triggering channel rejections.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Improper Authentication

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Improper Authentication due to the `Verify` method not checking the User Presence flag in FIDO/U2F security key types. An attacker can perform unauthorized authentication by generating signatures without requiring physical interaction with the hardware security key.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Incorrect Type Conversion or Cast

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast due to an incorrectly placed cast from bytes to int in the `AES-GCM packet decoder` process. An attacker can cause a server-side panic by sending specially crafted inputs.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Uncaught Exception

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Uncaught Exception in the `CertChecker` component when used as a public key callback without setting `IsUserAuthority` or `IsHostAuthority`. An attacker can cause the server to panic by presenting a crafted certificate.

Note:

This is only exploitable if both `IsUserAuthority` and `IsHostAuthority` are not set in the server configuration.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Allocation of Resources Without Limits or Throttling

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/helm/v3 › /usr/local/bin/helm
- Package Manager: golang
- Vulnerable module: github.com/moby/spdystream/spdy
- Introduced through: helm.sh/helm/v3@* and github.com/moby/spdystream/spdy@v0.5.0

### Detailed paths

- Introduced through: helm.sh/helm/v3@* › github.com/moby/spdystream/spdy@v0.5.0

## Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of validation on attacker-controlled counts and lengths in the SPDY/3 frame parser. An attacker can exhaust process memory and cause an out-of-memory crash by sending a single crafted control frame with compressed header blocks that decompress into large allocation sizes.

## Remediation

Upgrade `github.com/moby/spdystream/spdy` to version 0.5.1 or higher.

## References

- GitHub Advisory
- GitHub Commit
- GitHub Release

More about this vulnerability

## Insufficiently Protected Credentials

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/plumbing/transport/http
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/plumbing/transport/http@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/plumbing/transport/http@v5.14.0

## Overview

Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the `advertisedReferences()` function. The headers - including Authorization headers - from an initial `/info/refs` request are forwarded to redirect targets. An attacker can obtain authentication credentials by controlling a redirect target, and those credentials may be reused on other endpoints or attempted against other repositories owned by the victim. This is only exploitable if the client interacts with untrusted or misconfigured remote servers, or uses HTTP (not HTTPS) connections.

## Remediation

Upgrade `github.com/go-git/go-git/v5/plumbing/transport/http` to version 5.18.0 or higher.

## References

- GitHub Advisory
- GitHub Commit

More about this vulnerability

## Incorrect Behavior Order: Validate Before Canonicalize

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/plumbing/object
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/plumbing/object@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/plumbing/object@v5.14.0

## Overview

Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the parsing of Git objects with malformed or ambiguous `commit` or `tag` objects. An attacker can cause inconsistent interpretation of object metadata or signature validation by introducing specially crafted objects that are parsed differently than by upstream Git, potentially leading to the acceptance of commits with misleading or unintended metadata.

## Remediation

Upgrade `github.com/go-git/go-git/v5/plumbing/object` to version 5.19.0 or higher.

## References

- GitHub Advisory
- GitHub Commit

More about this vulnerability

## Authentication Bypass

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: util-linux/libblkid1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and util-linux/libblkid1@2.41-4ubuntu4.2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › e2fsprogs@1.47.2-3ubuntu2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libmount1@2.41-4ubuntu4.2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libuuid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › e2fsprogs@1.47.2-3ubuntu2 › util-linux/libuuid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libuuid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/liblastlog2-2@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/liblastlog2-2@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libmount1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libmount1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2 › util-linux/libmount1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libsmartcols1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libsmartcols1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2 › util-linux/libsmartcols1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/bsdutils@1:2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/login@1:4.16.0-2+really2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.

## Remediation

There is no fixed version for `Ubuntu:25.10` `util-linux`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-3184
- https://access.redhat.com/errata/RHSA-2026:7180
- https://access.redhat.com/security/cve/CVE-2026-3184
- https://bugzilla.redhat.com/show_bug.cgi?id=2442570

More about this vulnerability

## Time-of-check Time-of-use (TOCTOU)

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: util-linux/libblkid1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and util-linux/libblkid1@2.41-4ubuntu4.2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › e2fsprogs@1.47.2-3ubuntu2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libmount1@2.41-4ubuntu4.2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2 › util-linux/libblkid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libuuid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › e2fsprogs@1.47.2-3ubuntu2 › util-linux/libuuid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libuuid1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/liblastlog2-2@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/liblastlog2-2@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libmount1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libmount1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2 › util-linux/libmount1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/libsmartcols1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › util-linux/libsmartcols1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2 › util-linux/libsmartcols1@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/bsdutils@1:2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/login@1:4.16.0-2+really2.41-4ubuntu4.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/mount@2.41-4ubuntu4.2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

## Remediation

There is no fixed version for `Ubuntu:25.10` `util-linux`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-27456
- https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4
- https://github.com/util-linux/util-linux/releases/tag/v2.41.4
- https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g

More about this vulnerability

## Directory Traversal

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: tar
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and tar@1.35+dfsg-3.1build1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › tar@1.35+dfsg-3.1build1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › dpkg@1.22.21ubuntu3.2 › tar@1.35+dfsg-3.1build1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

## Remediation

There is no fixed version for `Ubuntu:25.10` `tar`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-45582
- https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md
- https://www.gnu.org/software/tar/
- https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html
- https://www.gnu.org/software/tar/manual/html_node/Integrity.html
- https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html
- http://www.openwall.com/lists/oss-security/2025/11/01/6

More about this vulnerability

## Unrestricted Upload of File with Dangerous Type

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: tar
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and tar@1.35+dfsg-3.1build1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › tar@1.35+dfsg-3.1build1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › dpkg@1.22.21ubuntu3.2 › tar@1.35+dfsg-3.1build1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `tar` package and not the `tar` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

## Remediation

There is no fixed version for `Ubuntu:25.10` `tar`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5704
- https://access.redhat.com/security/cve/CVE-2026-5704
- https://bugzilla.redhat.com/show_bug.cgi?id=2455360
- http://www.openwall.com/lists/oss-security/2026/04/11/10
- http://www.openwall.com/lists/oss-security/2026/04/11/11
- http://www.openwall.com/lists/oss-security/2026/04/12/2

More about this vulnerability

## Use of Less Trusted Source

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: systemd/libsystemd0
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and systemd/libsystemd0@257.9-0ubuntu2.4

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › procps/libproc2-0@2:4.0.4-8ubuntu3 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › procps@2:4.0.4-8ubuntu3 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/bsdutils@1:2.41-4ubuntu4.2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2 › pam/libpam-modules-bin@1.7.0-5ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › systemd/libudev1@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › systemd/libudev1@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › systemd/libudev1@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › systemd/libudev1@257.9-0ubuntu2.4

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

## Remediation

Upgrade `Ubuntu:25.10` `systemd` to version 257.9-0ubuntu2.5 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-40226
- https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx

More about this vulnerability

## CVE-2026-35354

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35354
- https://github.com/uutils/coreutils/issues/10014

More about this vulnerability

## CVE-2026-35344

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35344
- https://github.com/uutils/coreutils/issues/9745

More about this vulnerability

## CVE-2026-35360

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35360
- https://github.com/uutils/coreutils/issues/10019

More about this vulnerability

## CVE-2026-35378

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rather than at the execution phase. This implementation flaw prevents the utility from performing proper short-circuiting for logical OR (|) and AND (&) operations. As a result, arithmetic errors (such as division by zero) occurring within "dead" branches, branches that should be ignored due to short-circuiting, are raised as fatal errors. This divergence from GNU expr behavior can cause guarded expressions within shell scripts to fail with hard errors instead of returning expected boolean results, leading to premature script termination and breaking GNU-compatible shell control flow.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35378
- https://github.com/uutils/coreutils/pull/11395
- https://github.com/uutils/coreutils/releases/tag/0.8.0

More about this vulnerability

## CVE-2026-35361

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35361
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://github.com/uutils/coreutils/pull/10582

More about this vulnerability

## CVE-2026-35345

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35345
- https://github.com/uutils/coreutils/issues/10328

More about this vulnerability

## CVE-2026-35355

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35355
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://github.com/uutils/coreutils/pull/10067

More about this vulnerability

## CVE-2026-35379

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space character (0x20) in the [:graph:] class and excludes it from the [:print:] class, effectively reversing the standard behavior established by POSIX and GNU coreutils. This vulnerability leads to unintended data modification or loss when the utility is used in automated scripts or data-cleaning pipelines that rely on standard character class semantics. For example, a command executed to delete all graphical characters while intending to preserve whitespace will incorrectly delete all ASCII spaces, potentially resulting in data corruption or logic failures in downstream processing.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35379
- https://github.com/uutils/coreutils/pull/11405
- https://github.com/uutils/coreutils/releases/tag/0.8.0

More about this vulnerability

## CVE-2026-35366

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35366
- https://github.com/uutils/coreutils/pull/9728
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://github.com/uutils/coreutils/issues/9701

More about this vulnerability

## CVE-2026-35376

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup (via fts_accpath) rather than binding the traversal and label application to the specific directory state encountered during traversal. Because these operations are not anchored to file descriptors, a local attacker with write access to a directory tree can exploit timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories. This vulnerability breaks the hardening expectations for SELinux administration workflows and can lead to the unauthorized modification of security labels on sensitive system objects.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35376
- https://github.com/uutils/coreutils/pull/11402
- https://github.com/uutils/coreutils/releases/tag/0.8.0

More about this vulnerability

## CVE-2026-35374

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for identity between input and output files using their file paths before initiating the split operation. However, the utility subsequently opens the output file with truncation after this path-based validation is complete. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components (e.g., swapping a path with a symbolic link). This can cause split to truncate and write to an unintended target file, potentially including the input file itself or other sensitive files accessible to the process, leading to permanent data loss.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35374
- https://github.com/uutils/coreutils/pull/11401

More about this vulnerability

## CVE-2026-35340

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35340
- https://github.com/uutils/coreutils/pull/10035
- https://github.com/uutils/coreutils/releases/tag/0.6.0

More about this vulnerability

## CVE-2026-35375

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which automatically rewrites invalid byte sequences into the UTF-8 replacement character (U+FFFD). This behavior diverges from GNU split, which preserves raw pathname bytes intact. In environments utilizing non-UTF-8 encodings, this vulnerability leads to the creation of files with incorrect names, potentially causing filename collisions, broken automation, or the misdirection of output data.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35375
- https://github.com/uutils/coreutils/pull/11397
- https://github.com/uutils/coreutils/releases/tag/0.8.0

More about this vulnerability

## CVE-2026-35341

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35341
- https://github.com/uutils/coreutils/issues/10020

More about this vulnerability

## CVE-2026-35348

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35348
- https://github.com/uutils/coreutils/issues/9696

More about this vulnerability

## CVE-2026-35356

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35356
- https://github.com/uutils/coreutils/pull/10140
- https://github.com/uutils/coreutils/releases/tag/0.7.0

More about this vulnerability

## CVE-2026-35357

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35357
- https://github.com/uutils/coreutils/issues/10011

More about this vulnerability

## CVE-2026-35349

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35349
- https://github.com/uutils/coreutils/pull/9706
- https://github.com/uutils/coreutils/releases/tag/0.7.0

More about this vulnerability

## CVE-2026-35377

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \ and &#39;). However, the uutils implementation incorrectly attempts to validate these sequences, resulting in an "invalid sequence" error and an immediate process termination with an exit status of 125 when encountering valid but unrecognized sequences like \a or \x. This divergence from GNU behavior breaks compatibility for automated scripts and administrative workflows that rely on standard split-string semantics, leading to a local denial of service for those operations.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35377
- https://github.com/uutils/coreutils/pull/11512

More about this vulnerability

## CVE-2026-35367

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35367
- https://github.com/uutils/coreutils/issues/10021

More about this vulnerability

## CVE-2026-35358

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35358
- https://github.com/uutils/coreutils/pull/11163
- https://github.com/uutils/coreutils/releases/tag/0.7.0
- https://github.com/uutils/coreutils/issues/9746

More about this vulnerability

## CVE-2026-35364

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35364
- https://github.com/uutils/coreutils/issues/10015

More about this vulnerability

## CVE-2026-35359

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35359
- https://github.com/uutils/coreutils/issues/10017

More about this vulnerability

## CVE-2026-35365

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35365
- https://github.com/uutils/coreutils/pull/10546
- https://github.com/uutils/coreutils/releases/tag/0.7.0

More about this vulnerability

## CVE-2026-35371

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35371
- https://github.com/uutils/coreutils/issues/10006

More about this vulnerability

## CVE-2026-35370

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35370
- https://github.com/uutils/coreutils/issues/10006

More about this vulnerability

## CVE-2026-35342

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35342
- https://github.com/uutils/coreutils/pull/10566
- https://github.com/uutils/coreutils/releases/tag/0.6.0

More about this vulnerability

## CVE-2026-35352

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35352
- http://www.openwall.com/lists/oss-security/2026/05/04/4
- http://www.openwall.com/lists/oss-security/2026/05/04/5
- http://www.openwall.com/lists/oss-security/2026/05/04/6
- https://github.com/uutils/coreutils/issues/10020

More about this vulnerability

## CVE-2026-35380

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d (delimiter) and --output-delimiter options. This vulnerability can lead to silent data corruption or logic errors in automated scripts and data pipelines that process strings containing these characters, as the utility may unintentionally split or join data on NUL bytes rather than the intended literal characters.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35380
- https://github.com/uutils/coreutils/pull/11399
- https://github.com/uutils/coreutils/releases/tag/0.8.0

More about this vulnerability

## CVE-2026-35343

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts that rely on strict output filtering.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35343
- https://github.com/uutils/coreutils/pull/11143
- https://github.com/uutils/coreutils/releases/tag/0.7.0

More about this vulnerability

## CVE-2026-35381

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination through a specialized newline-delimiter code path that fails to check the record suppression status. Consequently, uutils cut emits the entire record plus a NUL byte instead of suppressing it. This divergence from GNU coreutils behavior creates a data integrity risk for automated pipelines that rely on cut -s to filter out undelimited data.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35381
- https://github.com/uutils/coreutils/pull/11394
- https://github.com/uutils/coreutils/releases/tag/0.8.0

More about this vulnerability

## CVE-2026-35362

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35362
- https://github.com/uutils/coreutils/pull/9792
- https://github.com/uutils/coreutils/releases/tag/0.6.0

More about this vulnerability

## CVE-2026-35353

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35353
- https://github.com/uutils/coreutils/pull/10036
- https://github.com/uutils/coreutils/releases/tag/0.6.0

More about this vulnerability

## CVE-2026-35363

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35363
- https://github.com/uutils/coreutils/issues/9749

More about this vulnerability

## CVE-2026-35351

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35351
- https://github.com/uutils/coreutils/issues/9714

More about this vulnerability

## CVE-2026-35347

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35347
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://github.com/uutils/coreutils/pull/9545

More about this vulnerability

## CVE-2026-35369

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35369
- https://github.com/uutils/coreutils/pull/9700
- https://github.com/uutils/coreutils/releases/tag/0.6.0

More about this vulnerability

## CVE-2026-35368

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35368
- https://github.com/uutils/coreutils/issues/10327

More about this vulnerability

## CVE-2026-35350

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35350
- https://github.com/uutils/coreutils/issues/9750

More about this vulnerability

## CVE-2026-35338

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35338
- https://github.com/uutils/coreutils/pull/10033
- https://github.com/uutils/coreutils/releases/tag/0.6.0

More about this vulnerability

## CVE-2026-35339

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35339
- https://github.com/uutils/coreutils/pull/9793
- https://github.com/uutils/coreutils/releases/tag/0.6.0

More about this vulnerability

## CVE-2026-35346

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the utility is used to compare binary files or files using non-UTF-8 legacy encodings.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35346
- https://github.com/uutils/coreutils/pull/10206
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://github.com/uutils/coreutils/issues/10192

More about this vulnerability

## CVE-2026-35372

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force (overwrite) mode was also enabled. This flaw causes ln to follow a symbolic link that points to a directory and create new links inside that target directory instead of treating the symbolic link itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35372
- https://github.com/uutils/coreutils/pull/11253
- https://github.com/uutils/coreutils/releases/tag/0.8.0

More about this vulnerability

## CVE-2026-35373

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: rust-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and rust-coreutils@0.2.2-0ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › rust-coreutils@0.2.2-0ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › rust-coreutils@0.2.2-0ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `rust-coreutils` package and not the `rust-coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.

## Remediation

There is no fixed version for `Ubuntu:25.10` `rust-coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35373
- https://github.com/uutils/coreutils/pull/11403

More about this vulnerability

## Directory Traversal

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: pam/libpam0g
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and pam/libpam0g@1.7.0-5ubuntu2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › pam/libpam0g@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › pam/libpam0g@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/login@1:4.16.0-2+really2.41-4ubuntu4.2 › pam/libpam0g@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam0g@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2 › pam/libpam0g@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2 › pam/libpam-modules-bin@1.7.0-5ubuntu2 › pam/libpam0g@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › pam/libpam-modules-bin@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2 › pam/libpam-modules-bin@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › pam/libpam-modules@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › pam/libpam-runtime@1.7.0-5ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › pam/libpam-modules@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/login@1:4.16.0-2+really2.41-4ubuntu4.2 › pam/libpam-modules@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › pam/libpam-runtime@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › pam/libpam-runtime@1.7.0-5ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/login@1:4.16.0-2+really2.41-4ubuntu4.2 › pam/libpam-runtime@1.7.0-5ubuntu2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `pam` package and not the `pam` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

## Remediation

There is no fixed version for `Ubuntu:25.10` `pam`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-8941
- https://access.redhat.com/security/cve/CVE-2025-8941
- https://bugzilla.redhat.com/show_bug.cgi?id=2388220
- https://access.redhat.com/errata/RHSA-2025:14557
- https://access.redhat.com/errata/RHSA-2025:15100
- https://access.redhat.com/errata/RHSA-2025:15104
- https://access.redhat.com/errata/RHSA-2025:15107
- https://access.redhat.com/errata/RHSA-2025:15099
- https://access.redhat.com/errata/RHSA-2025:15101
- https://access.redhat.com/errata/RHSA-2025:15102
- https://access.redhat.com/errata/RHSA-2025:15103
- https://access.redhat.com/errata/RHSA-2025:15105
- https://access.redhat.com/errata/RHSA-2025:15106
- https://access.redhat.com/errata/RHSA-2025:15709
- https://access.redhat.com/errata/RHSA-2025:15828
- https://access.redhat.com/errata/RHSA-2025:15827
- https://access.redhat.com/errata/RHSA-2025:16524
- https://access.redhat.com/errata/RHSA-2025:18219
- https://access.redhat.com/errata/RHSA-2025:17181
- https://access.redhat.com/errata/RHSA-2025:21885

More about this vulnerability

## CVE-2026-34183

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service.

A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives. The allocated PATH_RESPONSE frame gets freed only when the remote peer acknowledges reception of the PATH_RESPONSE frame which will not be done by a malicious peer.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue. The QUIC stack is outside of OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-34183
- https://github.com/openssl/security/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517
- https://github.com/openssl/security/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac
- https://github.com/openssl/security/commit/d2e9efbe4900a373227deb136e8665401404ffac
- https://github.com/openssl/security/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517
- https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac
- https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac
- https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb

More about this vulnerability

## CVE-2026-42764

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled.

Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service.

If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token.

By default, the client address validation is enabled in the OpenSSL QUIC server implementation, which makes the default configuration not vulnerable to this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with the SSL_new_listener() call, the address validation is disabled making the vulnerable code reachable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42764
- https://github.com/openssl/security/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729
- https://github.com/openssl/security/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677
- https://github.com/openssl/security/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729
- https://github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677
- https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91

More about this vulnerability

## CVE-2026-34182

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message.

In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL erroneously allows this selection, and attempts to decrypt and validate the message.

An on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData addressed to the victim can re-emit it with the recipientInfos set left byte-for-byte intact, so the victim's private key still unwraps the genuine CEK (the content-encryption key), but with the inner OID rewritten to AES-256-OFB (Output Feedback Mode, an unauthenticated keystream mode) and with an attacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the real CEK, never consults the MAC field, and CMS_decrypt() returns success.

If the application under attack responds to the attacker with any indicator showing success or failure of the decryption effort, it is possible for the attacker to use this as an oracle to obtain key equivalent functionality for the CEK used for the chosen recipient of the message.

In another use case, an attacker can reduce the tag length of the chosen AEAD cipher for a given AuthEnvelopedData container to be a single byte long, allowing an attacker to brute force CMS decryption, producing an integrity bypass for applications that trust CMS_decrypt() to reject modified content.

The FIPS modules are not affected by this issue.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-34182
- https://github.com/openssl/security/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
- https://github.com/openssl/security/commit/439ed7d2c0962ce964482727264668bf277c333f
- https://github.com/openssl/security/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
- https://github.com/openssl/security/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
- https://github.com/openssl/security/commit/d2ca86bcd43e4f17d899f347101766b6107676e0
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc
- https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f
- https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7
- https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
- https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0

More about this vulnerability

## CVE-2026-45445

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message.

OpenSSL provides two ways to drive a cipher: the documented streaming interface (EVP_CipherUpdate / EVP_CipherFinal_ex) and a lower-level one-shot, EVP_Cipher(), whose documentation explicitly recommends against use by applications in favour of EVP_CipherUpdate() and EVP_CipherFinal_ex(). The OCB provider's streaming handler flushes the application-supplied IV into the OCB context before processing data; the one-shot handler did not. Every call to EVP_Cipher() on an AES-OCB context therefore ran with the all-zero key-derived offset state left by cipher initialisation, regardless of the caller's IV.

If EVP_EncryptFinal_ex() is subsequently used to obtain the authentication tag, the deferred IV setup runs at that point and clears the running checksum that should have been accumulated over the plaintext. The resulting tag is a function of (key, IV) only and verifies against any ciphertext produced under the same (key, IV) pair.

The OpenSSL SSL/TLS implementation is not affected: AES-OCB is not a TLS cipher suite, and libssl does not call EVP_Cipher() in any case. Applications that drive AES-OCB through the documented streaming AEAD API (EVP_CipherUpdate / EVP_CipherFinal_ex) are not affected. Only applications that combine the AES-OCB cipher with the EVP_Cipher() one-shot API are vulnerable.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as AES-OCB is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45445
- https://github.com/openssl/security/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
- https://github.com/openssl/security/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
- https://github.com/openssl/security/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
- https://github.com/openssl/security/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
- https://github.com/openssl/security/commit/983d54b5cce8d16147548ed1a37892d1720bbab6
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451
- https://github.com/openssl/openssl/commit/787a6dfba81b7b09c1e05ab31396c0cd7c36b3f7
- https://github.com/openssl/openssl/commit/7ac4715234ee72d9f3c93426a2c08554b5b771af
- https://github.com/openssl/openssl/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
- https://github.com/openssl/openssl/commit/983d54b5cce8d16147548ed1a37892d1720bbab6

More about this vulnerability

## Cross-site Scripting (XSS)

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/net/html
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/html@v0.52.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/html@v0.52.0
- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/html@v0.47.0

## Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `inBodyEndTagOther()` function, when rendering sanitized HTML. An attacker can cause the execution of scripts in the context of the affected application by providing malicious HTML input containing unmatched tags.

## Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

### Types of attacks

There are a few methods by which XSS can be manipulated:

Type | Origin | Description
--- | --- | ---
Stored | Server | The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected | Server | The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based | Client | The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated |  | The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

### Affected environments

The following environments are susceptible to an XSS attack:

- Web servers
- Application servers
- Web application environments

### How to prevent

This section describes the top best practices designed to specifically protect your code:

- Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
- Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents.
- Give users the option to disable client-side scripts.
- Redirect invalid requests.
- Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
- Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
- Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

## Remediation

Upgrade `golang.org/x/net/html` to version 0.55.0 or higher.

## References

- GitHub Commit
- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Cross-site Scripting (XSS)

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/net/html
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/html@v0.52.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/html@v0.52.0
- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/html@v0.47.0

## Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `readStartTag()` function in the `Tokenizer`. An attacker can cause the execution of scripts in the context of the affected application by supplying malicious HTML with duplicate attributes.

## Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

### Types of attacks

There are a few methods by which XSS can be manipulated:

Type | Origin | Description
--- | --- | ---
Stored | Server | The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected | Server | The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based | Client | The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated |  | The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

### Affected environments

The following environments are susceptible to an XSS attack:

- Web servers
- Application servers
- Web application environments

### How to prevent

This section describes the top best practices designed to specifically protect your code:

- Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
- Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents.
- Give users the option to disable client-side scripts.
- Redirect invalid requests.
- Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
- Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
- Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

## Remediation

Upgrade `golang.org/x/net/html` to version 0.55.0 or higher.

## References

- GitHub Commit
- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Cross-site Scripting (XSS)

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/net/html
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/html@v0.52.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/html@v0.52.0
- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/html@v0.47.0

## Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `childTextNodesAreLiteral()` function in `render.go. An attacker can cause the execution of scripts in the context of the affected application by providing malicious HTML input containing fostered elements that are outside their parent namespace.

## Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

### Types of attacks

There are a few methods by which XSS can be manipulated:

Type | Origin | Description
--- | --- | ---
Stored | Server | The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected | Server | The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based | Client | The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated |  | The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

### Affected environments

The following environments are susceptible to an XSS attack:

- Web servers
- Application servers
- Web application environments

### How to prevent

This section describes the top best practices designed to specifically protect your code:

- Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
- Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents.
- Give users the option to disable client-side scripts.
- Redirect invalid requests.
- Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
- Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
- Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

## Remediation

Upgrade `golang.org/x/net/html` to version 0.55.0 or higher.

## References

- GitHub Commit
- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Cross-site Scripting (XSS)

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/net/html
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/html@v0.52.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/html@v0.52.0
- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/html@v0.47.0

## Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the `writeQuoted()` function, which does not properly handle `>` characters in DOCTYPE data. An attacker can cause the execution of scripts in the context of the affected application by providing malicious HTML input that contains unescaped `>`s.

## Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

### Types of attacks

There are a few methods by which XSS can be manipulated:

Type | Origin | Description
--- | --- | ---
Stored | Server | The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.
Reflected | Server | The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.
DOM-based | Client | The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.
Mutated |  | The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.

### Affected environments

The following environments are susceptible to an XSS attack:

- Web servers
- Application servers
- Web application environments

### How to prevent

This section describes the top best practices designed to specifically protect your code:

- Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
- Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents.
- Give users the option to disable client-side scripts.
- Redirect invalid requests.
- Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
- Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
- Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

## Remediation

Upgrade `golang.org/x/net/html` to version 0.55.0 or higher.

## References

- GitHub Commit
- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Inefficient Algorithmic Complexity

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/net/html
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/net/html@v0.52.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/net/html@v0.52.0
- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/html@v0.47.0

## Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in `parse.go`, when checking attributes iteratively. An attacker can cause excessive CPU consumption by providing malicious HTML input.

## Remediation

Upgrade `golang.org/x/net/html` to version 0.55.0 or higher.

## References

- GitHub Commit
- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Improper Check for Dropped Privileges

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh/agent
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh/agent@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh/agent@v0.49.0

## Overview

Affected versions of this package are vulnerable to Improper Check for Dropped Privileges due to the omission of constraint extensions such as `restrict-destination-v00@openssh.com` when adding a key to a remote agent. An attacker can bypass intended key usage restrictions by forwarding keys without the associated constraints, enabling unrestricted use of the key on the remote host.

## Remediation

Upgrade `golang.org/x/crypto/ssh/agent` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Missing Authorization

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh/agent
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh/agent@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh/agent@v0.49.0

## Overview

Affected versions of this package are vulnerable to Missing Authorization due to the `NewKeyring` function not enforcing the `ConfirmBeforeUse` constraint. An attacker can perform unauthorized signing operations by adding keys with constraints that are silently ignored.

## Remediation

Upgrade `golang.org/x/crypto/ssh/agent` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Allocation of Resources Without Limits or Throttling

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the public key parsers. An attacker can exhaust CPU resources by submitting crafted RSA or DSA public keys with excessively large parameters during signature verification. This can be triggered by unauthenticated clients during public key authentication.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Integer Overflow or Wraparound

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the payload size calculation within the `Write` process. An attacker can cause the process to enter an infinite loop and exhaust system resources by sending a single write operation with data larger than 4GB.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Missing Release of Resource after Effective Lifetime

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the handling of unsolicited global request responses, which can fill an internal buffer and block the connection's read loop. An attacker can cause a resource leak and prevent the release of blocked goroutines by sending unexpected responses.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Incorrect Authorization

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Incorrect Authorization. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Incorrect Authorization

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: golang.org/x/crypto/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and golang.org/x/crypto/ssh@v0.49.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › golang.org/x/crypto/ssh@v0.49.0

## Overview

golang.org/x/crypto/ssh is a SSH client and server

Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of permissions in the `VerifiedPublicKeyCallback` process. An attacker can bypass source-address validation by passing a callback type other than public key.

## Remediation

Upgrade `golang.org/x/crypto/ssh` to version 0.52.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue
- Google Groups Forum

More about this vulnerability

## Memory Allocation with Excessive Size Value

medium severity
Exploit: Proof of Concept

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: go.opentelemetry.io/otel/propagation
- Introduced through: github.com/argoproj/argo-cd/v3@* and go.opentelemetry.io/otel/propagation@v1.43.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › go.opentelemetry.io/otel/propagation@v1.43.0

## Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the `Parse` function. An attacker can exhaust CPU resources and generate excessive log output by sending oversized or malformed headers that are processed without length checks.

## Remediation

Upgrade `go.opentelemetry.io/otel/propagation` to version 1.44.0 or higher.

## References

- GitHub Advisory
- GitHub Commit

More about this vulnerability

## Improper Verification of Cryptographic Signature

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: gnupg2/gpgv
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and gnupg2/gpgv@2.4.8-2ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpgv@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › gnupg2/gpgv@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg@2.4.8-2ubuntu2.1 › gnupg2/gpgconf@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg-agent@2.4.8-2ubuntu2.1 › gnupg2/gpgconf@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg-agent@2.4.8-2ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

## Remediation

There is no fixed version for `Ubuntu:25.10` `gnupg2`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-68972
- https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i
- https://news.ycombinator.com/item?id=46404339
- https://gpg.fail/formfeed

More about this vulnerability

## CVE-2026-4437

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: glibc/libc-bin
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and glibc/libc-bin@2.42-0ubuntu3.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc-bin@2.42-0ubuntu3.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc6@2.42-0ubuntu3.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

## Remediation

There is no fixed version for `Ubuntu:25.10` `glibc`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4437
- https://sourceware.org/bugzilla/show_bug.cgi?id=34014

More about this vulnerability

## CVE-2026-4438

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: glibc/libc-bin
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and glibc/libc-bin@2.42-0ubuntu3.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc-bin@2.42-0ubuntu3.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc6@2.42-0ubuntu3.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

## Remediation

There is no fixed version for `Ubuntu:25.10` `glibc`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4438
- https://sourceware.org/bugzilla/show_bug.cgi?id=34015

More about this vulnerability

## CVE-2026-4046

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: glibc/libc-bin
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and glibc/libc-bin@2.42-0ubuntu3.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc-bin@2.42-0ubuntu3.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc6@2.42-0ubuntu3.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

## Remediation

There is no fixed version for `Ubuntu:25.10` `glibc`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4046
- https://sourceware.org/bugzilla/show_bug.cgi?id=33980
- https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD
- https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/#u

More about this vulnerability

## CVE-2026-6238

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: glibc/libc-bin
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and glibc/libc-bin@2.42-0ubuntu3.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc-bin@2.42-0ubuntu3.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc6@2.42-0ubuntu3.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

## Remediation

There is no fixed version for `Ubuntu:25.10` `glibc`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6238
- https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u
- https://sourceware.org/bugzilla/show_bug.cgi?id=34069

More about this vulnerability

## CVE-2026-5435

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: glibc/libc-bin
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and glibc/libc-bin@2.42-0ubuntu3.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc-bin@2.42-0ubuntu3.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › glibc/libc6@2.42-0ubuntu3.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.

## Remediation

There is no fixed version for `Ubuntu:25.10` `glibc`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5435
- https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u
- https://sourceware.org/bugzilla/show_bug.cgi?id=34033

More about this vulnerability

## Improper Validation of Specified Type of Input

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/vmihailenco/msgpack/v5
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/vmihailenco/msgpack/v5@v5.4.1

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/vmihailenco/msgpack/v5@v5.4.1

## Overview

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the calls plugin when handling websocket messages containing malformed msgpack frames. An attacker can cause the server to consume excessive memory and crash by sending specially crafted websocket requests.

## Remediation

There is no fixed version for `github.com/vmihailenco/msgpack/v5`.

## References

- GitHub Commit
- Mattermost Security Updates

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/r3labs/diff/v3
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/r3labs/diff/v3@v3.0.2

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/r3labs/diff/v3@v3.0.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/hashicorp/go-version
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/go-version@v1.7.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/go-version@v1.7.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.4.3 › /usr/local/bin/git-lfs
- Package Manager: golang
- Module: github.com/hashicorp/go-uuid
- Introduced through: go-distribution@command-line-arguments@* and github.com/hashicorp/go-uuid@v1.0.2

### Detailed paths

- Introduced through: go-distribution@command-line-arguments@* › github.com/hashicorp/go-uuid@v1.0.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/hashicorp/go-retryablehttp
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/go-retryablehttp@v0.7.8

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/go-retryablehttp@v0.7.8

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.4.3/helm/v3 › /usr/local/bin/helm
- Package Manager: golang
- Module: github.com/hashicorp/go-multierror
- Introduced through: helm.sh/helm/v3@* and github.com/hashicorp/go-multierror@v1.1.1

### Detailed paths

- Introduced through: helm.sh/helm/v3@* › github.com/hashicorp/go-multierror@v1.1.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/hashicorp/go-cleanhttp
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/go-cleanhttp@v0.5.2

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/go-cleanhttp@v0.5.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/gosimple/slug
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/gosimple/slug@v1.15.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/gosimple/slug@v1.15.0

MPL-2.0 license

More about this vulnerability

## Directory Traversal

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/storage/filesystem/dotgit
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/storage/filesystem/dotgit@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/storage/filesystem/dotgit@v5.14.0

## Overview

Affected versions of this package are vulnerable to Directory Traversal due to improper path validation in the repository checkout process. An attacker can modify files outside the intended target directory, including `.git` directories, by supplying a maliciously crafted repository payload. This is only exploitable if the repository is cloned or checked out from untrusted sources and the `.git` directory is stored within the same filesystem as the worktree, particularly when submodules are present.

## Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

`st` is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the `public` route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

    curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note `%2e` is the URL encoded version of `.` (dot).

- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`.

One way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:

    2018-04-15 22:04:29 .....           19           19  good.txt
            2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

## Remediation

Upgrade `github.com/go-git/go-git/v5/storage/filesystem/dotgit` to version 5.19.1, 6.0.0-alpha.4 or higher.

## References

- GitHub Advisory
- GitHub Commit

More about this vulnerability

## Improper Validation of Integrity Check Value

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/storage/filesystem
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/storage/filesystem@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/storage/filesystem@v5.14.0

## Overview

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value for `.idx` and `.pack` files. An attacker can cause the application to consume corrupted files, leading to unexpected errors, due to checksums not being checked in the `loadIdxFile()` function.

## Workaround

This vulnerability can be mitigated by running 'git fsck' from the git CLI to check for data corruption on a given repository.

## Remediation

Upgrade `github.com/go-git/go-git/v5/storage/filesystem` to version 5.16.5 or higher.

## References

- GitHub Commit
- GitHub Release

More about this vulnerability

## Allocation of Resources Without Limits or Throttling

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/plumbing/format/packfile
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/plumbing/format/packfile@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/plumbing/format/packfile@v5.14.0

## Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as `.pack`, `.idx`, or loose objects. An attacker can cause the application to panic by providing a payload that exceeds the declared size of a slice for `isCopyFromDelta()`, or consume excessive resources by sending an unlimited stream of calls to `isCopyFromDelta()` or a stream of calls with excessively large `targetSz` values (i.e. amplification).

Note: This is only exploitable if the attacker can alter read-only files in the local repository's `.git/objects/pack/` directory or if the user interacts with a malicious remote server.

## Remediation

Upgrade `github.com/go-git/go-git/v5/plumbing/format/packfile` to version 5.19.1 or higher.

## References

- GitHub Advisory
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Commit

More about this vulnerability

## Allocation of Resources Without Limits or Throttling

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/plumbing/format/index
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/plumbing/format/index@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/plumbing/format/index@v5.14.0

## Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the handling of `.idx` files. An attacker with write access to the local repository's `.git` directory can exhaust system memory by introducing a maliciously crafted `.idx` file into the `.git` directory.

## Remediation

Upgrade `github.com/go-git/go-git/v5/plumbing/format/index` to version 5.17.1 or higher.

## References

- GitHub Advisory
- GitHub Commit
- GitHub Commit

More about this vulnerability

## Improper Validation of Array Index

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/plumbing/format/index
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/plumbing/format/index@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/plumbing/format/index@v5.14.0

## Overview

Affected versions of this package are vulnerable to Improper Validation of Array Index through improper validation in the index decoding for version 4 files. An attacker with write access to the `.git` directory to modify or inject the index file can cause a panic and terminate the process by supplying a maliciously crafted `.git/index` file that triggers an out-of-bounds slice operation during index parsing.

## Remediation

Upgrade `github.com/go-git/go-git/v5/plumbing/format/index` to version 5.17.1 or higher.

## References

- GitHub Advisory
- GitHub Commit

More about this vulnerability

## Allocation of Resources Without Limits or Throttling

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/plumbing/format/idxfile
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/plumbing/format/idxfile@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/plumbing/format/idxfile@v5.14.0

## Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the parsing of maliciously crafted Git repository data, such as `.pack`, `.idx`, or loose objects. An attacker can cause the application to panic by providing a payload that exceeds the declared size of a slice for `isCopyFromDelta()`, or consume excessive resources by sending an unlimited stream of calls to `isCopyFromDelta()` or a stream of calls with excessively large `targetSz` values (i.e. amplification).

Note: This is only exploitable if the attacker can alter read-only files in the local repository's `.git/objects/pack/` directory or if the user interacts with a malicious remote server.

## Remediation

Upgrade `github.com/go-git/go-git/v5/plumbing/format/idxfile` to version 5.19.1 or higher.

## References

- GitHub Advisory
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Commit
- GitHub Commit

More about this vulnerability

## Improper Encoding or Escaping of Output

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: git/git-man
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3, git@1:2.51.0-1ubuntu1 and others

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › git/git-man@1:2.51.0-1ubuntu1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `git` package and not the `git` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources.

## Remediation

There is no fixed version for `Ubuntu:25.10` `git`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-52005
- https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329
- https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net

More about this vulnerability

## Algorithmic Complexity

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: expat/libexpat1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3, git@1:2.51.0-1ubuntu1 and others

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › expat/libexpat1@2.7.1-2ubuntu0.2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `expat` package and not the `expat` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

## Remediation

There is no fixed version for `Ubuntu:25.10` `expat`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-66382
- https://github.com/libexpat/libexpat/issues/1076
- http://www.openwall.com/lists/oss-security/2025/12/02/1
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html

More about this vulnerability

## Heap-based Buffer Overflow

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: xz-utils/liblzma5
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and xz-utils/liblzma5@5.8.1-1build2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › xz-utils/liblzma5@5.8.1-1build2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › dpkg@1.22.21ubuntu3.2 › xz-utils/liblzma5@5.8.1-1build2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › xz-utils/liblzma5@5.8.1-1build2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `xz-utils` package and not the `xz-utils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.

## Remediation

Upgrade `Ubuntu:25.10` `xz-utils` to version 5.8.1-1ubuntu0.1 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-34743
- https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87
- https://github.com/tukaani-project/xz/releases/tag/v5.8.3
- https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv
- http://www.openwall.com/lists/oss-security/2026/03/31/13

More about this vulnerability

## Incorrect Resource Transfer Between Spheres

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: systemd/libsystemd0
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and systemd/libsystemd0@257.9-0ubuntu2.4

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › procps/libproc2-0@2:4.0.4-8ubuntu3 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › procps@2:4.0.4-8ubuntu3 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/bsdutils@1:2.41-4ubuntu4.2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › pam/libpam-modules@1.7.0-5ubuntu2 › pam/libpam-modules-bin@1.7.0-5ubuntu2 › systemd/libsystemd0@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › systemd/libudev1@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux@2.41-4ubuntu4.2 › systemd/libudev1@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › systemd/libudev1@257.9-0ubuntu2.4
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › systemd/libudev1@257.9-0ubuntu2.4

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `systemd` package and not the `systemd` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if ForwardToWall=yes is set.

## Remediation

There is no fixed version for `Ubuntu:25.10` `systemd`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-40228
- https://www.openwall.com/lists/oss-security/2026/04/08/1
- http://www.openwall.com/lists/oss-security/2026/05/05/1

More about this vulnerability

## CVE-2024-56433

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: shadow/login.defs
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and shadow/login.defs@1:4.17.4-2ubuntu2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › shadow/login.defs@1:4.17.4-2ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › util-linux/login@1:4.16.0-2+really2.41-4ubuntu4.2 › shadow/login.defs@1:4.17.4-2ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2 › shadow/login.defs@1:4.17.4-2ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › shadow/passwd@1:4.17.4-2ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › shadow/passwd@1:4.17.4-2ubuntu2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › adduser@3.152ubuntu1 › shadow/passwd@1:4.17.4-2ubuntu2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `shadow` package and not the `shadow` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

## Remediation

There is no fixed version for `Ubuntu:25.10` `shadow`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-56433
- https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241
- https://github.com/shadow-maint/shadow/issues/1157
- https://github.com/shadow-maint/shadow/releases/tag/4.4

More about this vulnerability

## CVE-2026-34180

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms.

Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated.

An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer.

Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-34180
- https://github.com/openssl/security/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d
- https://github.com/openssl/security/commit/cbe418ae978539cf14a398a207dba834c0e93e83
- https://github.com/openssl/security/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff
- https://github.com/openssl/security/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43
- https://github.com/openssl/security/commit/f696c73c3e61b8c502d040af62e690c060908a16
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d
- https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83
- https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff
- https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43
- https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16

More about this vulnerability

## CVE-2026-34181

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery.

Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability.

If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker.

The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-34181
- https://github.com/openssl/security/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f
- https://github.com/openssl/security/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610
- https://github.com/openssl/security/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7
- https://github.com/openssl/security/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f
- https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610
- https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7
- https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81

More about this vulnerability

## CVE-2026-42768

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output.

Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key.

The attack is possible in 2 variants.

1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the first success.

An attacker who authors a message with two KTRI entries — the first one wrapping a real CEK under the victim's public key, the second with an arbitrary probe ciphertext — obtains opportunity to iterate the 2nd KTRI to get a valid PKCS#1 v1.5 padding if the error code of the application is available.

That is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an adaptive-chosen-ciphertext side channel from which the attacker decrypts any RSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under it.

2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with the recipient certificate, and the recipient is not found, a random key is substituted.

An attacker who authors a message and is able to compare both error code and the result of the decryption, can mount a Bleichenbacher oracle.

We are not aware of any applications that provide a remote attacker an opportunity to mount an attack described in these scenarios. We consider the existence of such application very unlikely, and for this reason this CVE has been evaluated as Low severity.

To avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described in draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit rejection was explicitly disabled.

The implicit rejection mechanism always returns a plaintext value, the symmetric key. This result is deterministic for the ciphertext and the private key. The length of the decryption result can happen to match the length of the key of the symmetric cipher that was used for the content encryption. When a certificate is not provided, the last RecipientInfo producing a key that looks valid will be used. It may cause getting garbage content on decryption. As a proper way to deal with this a recipient certificate has to be provided to identify the particular RecipientInfo for decryption.

The FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as CMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42768
- https://github.com/openssl/security/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f
- https://github.com/openssl/security/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d
- https://github.com/openssl/security/commit/dd68364107a58841c0a2546812518b65d3a23abd
- https://github.com/openssl/security/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f
- https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d
- https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd
- https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e

More about this vulnerability

## CVE-2026-42769

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level.

Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate.

One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new one.

The 'id-it-rootCaKeyUpdate' messages are expected to be processed with OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot') to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name and the algorithm OIDs were verified by other parts of the verification code).

An attacker who already has credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would accept as a new trust anchor.

Significant preconditions for the attack (having valid RA-level credentials) are the reason the issue was assigned Low severity.

The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42769
- https://github.com/openssl/security/commit/54d0989997e5fc26057009a9782c3441ce3842fb
- https://github.com/openssl/security/commit/777b363b16fcf2153bb3ded39dc3838713667c44
- https://github.com/openssl/security/commit/d35cd473a271bf3ce7bf3d32af53217fb83ae92c
- https://github.com/openssl/security/commit/d531f21c0fe99067a66fc0ff1161ef127f9cd70b
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/54d0989997e5fc26057009a9782c3441ce3842fb
- https://github.com/openssl/openssl/commit/777b363b16fcf2153bb3ded39dc3838713667c44
- https://github.com/openssl/openssl/commit/d35cd473a271bf3ce7bf3d32af53217fb83ae92c
- https://github.com/openssl/openssl/commit/d531f21c0fe99067a66fc0ff1161ef127f9cd70b

More about this vulnerability

## CVE-2026-42767

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application.

Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service.

An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client.

Applications that process untrusted CMP/CRMF messages may be affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42767
- https://github.com/openssl/security/commit/61a86a8cd73546c9fea916f3d304c1293e05c046
- https://github.com/openssl/security/commit/665d5254083affde9982efca7c41dd01cacc8774
- https://github.com/openssl/security/commit/810b722f772652ad48042bcc7ab07e3414b11d0f
- https://github.com/openssl/security/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873
- https://github.com/openssl/security/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046
- https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774
- https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f
- https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873
- https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d

More about this vulnerability

## CVE-2026-42770

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership.

Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts.

When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared.

A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack).

The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42770
- https://github.com/openssl/security/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02
- https://github.com/openssl/security/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb
- https://github.com/openssl/security/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c
- https://github.com/openssl/security/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2
- https://github.com/openssl/security/commit/ca2237ab5615641b662183b077f62c08d75e8070
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02
- https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb
- https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c
- https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2
- https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070

More about this vulnerability

## CVE-2026-45446

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages.

Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers.

AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the tag is verified succesfully.

In OpenSSL's provider implementation of these ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update, which can happen when the received ciphertext length is zero, the tag is never recalculated and still holds its all-zeros value.

When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context without resetting the key.

AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since OpenSSL 3.2.

No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not FIPS approved and the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-45446
- https://github.com/openssl/security/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
- https://github.com/openssl/security/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3
- https://github.com/openssl/security/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85
- https://github.com/openssl/security/commit/daca0f48e4a69a2892a62262bad59e62a8a76598
- https://github.com/openssl/security/commit/eec5e9bf0d867333b8495e456f5235d225798a68
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
- https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3
- https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85
- https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598
- https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68

More about this vulnerability

## CVE-2026-42766

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption.

Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service.

The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without first checking whether it was present.

An attacker who supplies such a CMS message to an application performing password-based CMS decryption can trigger an application crash, leading to a Denial of Service.

Applications that process password-encrypted CMS messages may be affected.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-42766
- https://github.com/openssl/security/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce
- https://github.com/openssl/security/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4
- https://github.com/openssl/security/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7
- https://github.com/openssl/security/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4
- https://github.com/openssl/security/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce
- https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4
- https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7
- https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4
- https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8

More about this vulnerability

## CVE-2026-9076

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key().

Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the attacker.

The key unwrapping function performs a check-byte test as specified in the RFC that reads 7 bytes from a heap allocation that is based on the wrapped key length from the message. There is a minimum length check based on the block length of the wrapping cipher. However the cipher is selected from an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no requirement that the cipher be a block cipher. When an attacker selects a stream-mode cipher the guard will be ineffective and the allocated buffer containing the unwrapped key can be too small to fit the check-bytes specified in the RFC and a buffer over-read can happen.

Applications calling CMS_decrypt() or CMS_decrypt_set1_password() (equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS data are vulnerable to this issue. No password knowledge is required: the over-read happens during the unwrap attempt before any authentication succeeds.

The over-read is limited to a few bytes and is not written to output, so there is no information disclosure. Triggering a crash requires the allocation to border unmapped memory, which is unlikely with the normal allocator.

The FIPS modules are not affected by this issue.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-9076
- https://github.com/openssl/security/commit/05b066366842f930fadd9a6e94df98030af431bb
- https://github.com/openssl/security/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0
- https://github.com/openssl/security/commit/715349a1d7c6db970e6815dafb90915f07307f98
- https://github.com/openssl/security/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26
- https://github.com/openssl/security/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb
- https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0
- https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98
- https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26
- https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6

More about this vulnerability

## CVE-2026-7383

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: openssl/openssl-provider-legacy
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3 › openssl/openssl-provider-legacy@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › apt/libapt-pkg7.0@3.1.6ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › openssh/openssh-client@1:10.0p1-5ubuntu5.4 › libfido2/libfido2-1@1.16.0-2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › libssh2/libssh2-1t64@1.11.1-1ubuntu0.25.10.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › krb5/libgssapi-krb5-2@1.21.3-5ubuntu2 › krb5/libkrb5-3@1.21.3-5ubuntu2 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › git@1:2.51.0-1ubuntu1 › curl/libcurl3t64-gnutls@8.14.1-2ubuntu1.3 › openldap/libldap2@2.6.10+dfsg-1ubuntu2.1 › cyrus-sasl2/libsasl2-2@2.1.28+dfsg1-9ubuntu1 › openssl/libssl3t64@3.5.3-1ubuntu3.3
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › ca-certificates@20250419 › openssl@3.5.3-1ubuntu3.3

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `openssl` package and not the `openssl` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow.

Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour.

In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UTF-32), and by summing per-character byte counts for UTF8STRING. The calculation overflows when the input reaches around 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30 characters) the size wraps to zero, OPENSSL_malloc(1) is called, and the subsequent character copy writes several gigabytes past the one-byte allocation.

X.509 certificate processing routes through ASN1_STRING_set_by_NID(), whose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID size limits cap the input length; no network protocol or certificate-handling path in OpenSSL exercises the overflow. Triggering the bug requires an application that calls ASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers a custom string type via ASN1_STRING_TABLE_add(), with attacker-controlled input on the order of half a gigabyte or more. For these reasons this issue was assigned Low severity.

The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

## Remediation

Upgrade `Ubuntu:25.10` `openssl` to version 3.5.3-1ubuntu3.4 or higher.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-7383
- https://github.com/openssl/security/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6
- https://github.com/openssl/security/commit/80c15faaf78042bbb8654a0e234c50c381732f74
- https://github.com/openssl/security/commit/bd17511070fb39a67bfa19682affb765e706a974
- https://github.com/openssl/security/commit/c332adaced43bcbb85f97410597e951c11ec3083
- https://github.com/openssl/security/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255
- https://openssl-library.org/news/secadv/20260609.txt
- https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6
- https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74
- https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974
- https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083
- https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255

More about this vulnerability

## Covert Timing Channel

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: libgcrypt20
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and libgcrypt20@1.11.0-7ubuntu0.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › libgcrypt20@1.11.0-7ubuntu0.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg@2.4.8-2ubuntu2.1 › libgcrypt20@1.11.0-7ubuntu0.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg-agent@2.4.8-2ubuntu2.1 › libgcrypt20@1.11.0-7ubuntu0.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › gnupg2/gpgv@2.4.8-2ubuntu2.1 › libgcrypt20@1.11.0-7ubuntu0.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg@2.4.8-2ubuntu2.1 › gnupg2/gpgconf@2.4.8-2ubuntu2.1 › libgcrypt20@1.11.0-7ubuntu0.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `libgcrypt20` package and not the `libgcrypt20` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

## Remediation

There is no fixed version for `Ubuntu:25.10` `libgcrypt20`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2024-2236
- https://access.redhat.com/errata/RHSA-2024:9404
- https://bugzilla.redhat.com/show_bug.cgi?id=2268268
- https://access.redhat.com/errata/RHSA-2025:3534
- https://access.redhat.com/errata/RHSA-2025:3530
- https://access.redhat.com/security/cve/CVE-2024-2236
- https://bugzilla.redhat.com/show_bug.cgi?id=2245218

More about this vulnerability

## Out-of-bounds Write

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: gnupg2/gpgv
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and gnupg2/gpgv@2.4.8-2ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpgv@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › apt@3.1.6ubuntu2 › gnupg2/gpgv@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg@2.4.8-2ubuntu2.1 › gnupg2/gpgconf@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg-agent@2.4.8-2ubuntu2.1 › gnupg2/gpgconf@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg@2.4.8-2ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › gnupg2/gpg-agent@2.4.8-2ubuntu2.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `gnupg2` package and not the `gnupg2` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

## Remediation

There is no fixed version for `Ubuntu:25.10` `gnupg2`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2022-3219
- https://access.redhat.com/security/cve/CVE-2022-3219
- https://bugzilla.redhat.com/show_bug.cgi?id=2127010
- https://dev.gnupg.org/D556
- https://dev.gnupg.org/T5993
- https://marc.info/?l=oss-security&m=165696590211434&w=4
- https://security.netapp.com/advisory/ntap-20230324-0001/

More about this vulnerability

## Improper Encoding or Escaping of Output

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/plumbing/transport/ssh
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/plumbing/transport/ssh@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/plumbing/transport/ssh@v5.14.0

## Overview

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output due to improper escaping of single quotes in the SSH transport command construction process. An attacker can inject arbitrary shell tokens by including single quotes in the repository path, potentially leading to unintended command execution on SSH servers that evaluate the exec command through a shell.

## Remediation

Upgrade `github.com/go-git/go-git/v5/plumbing/transport/ssh` to version 5.19.1, 6.0.0-alpha.4 or higher.

## References

- GitHub Advisory
- GitHub Commit

More about this vulnerability

## Improper Input Validation

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.4.3/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.10
- Vulnerable module: coreutils/gnu-coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 and coreutils/gnu-coreutils@9.5-1ubuntu4.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils/gnu-coreutils@9.5-1ubuntu4.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › tzdata@2026a-0ubuntu0.25.10.1 › coreutils/gnu-coreutils@9.5-1ubuntu4.1
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.4.3 › coreutils-from/coreutils@9.5-1ubuntu2+0.0.0~ubuntu24 › coreutils-from/coreutils-from-uutils@0.0.0~ubuntu24 › coreutils/gnu-coreutils@9.5-1ubuntu4.1

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `coreutils` package and not the `coreutils` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.10` relevant fixed versions and status.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

## Remediation

There is no fixed version for `Ubuntu:25.10` `coreutils`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781
- https://security-tracker.debian.org/tracker/CVE-2016-2781
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
- http://www.openwall.com/lists/oss-security/2016/02/28/2
- http://www.openwall.com/lists/oss-security/2016/02/28/3
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

More about this vulnerability