Security updates¶
This page lists the list of fixed CVEs for this release.
List of fixed CVEs¶
The following table lists the Common Vulnerabilities and Exposures (CVE) fixes included in this release.
| CVE number | Bug IDs | Image names | Package name |
|---|---|---|---|
| CVE-2025-1352 | 2313045 | frontend | libelf1t64 |
| CVE-2025-1376 | 2313049 | frontend | libelf1t64 |
| CVE-2025-14017 | 2312749 | curl | curl |
| CVE-2025-14524 | 2312769 | curl | curl |
| CVE-2025-14819 | 2312773 | curl | curl |
| CVE-2025-29481 | 2313053 | frontend | libbpf1 |
| CVE-2025-5222 | 2313057 | frontend | libicu74 |
| CVE-2026-1965 | 2312753 | curl | curl |
| CVE-2026-2219 | 2313109 | baseos | dpkg |
| CVE-2026-25679 | 2312481 | backend | stdlib |
| CVE-2026-2673 | 2312729 | vault | libcrypto3 |
| CVE-2026-27135 | 2312313 | postgresql | nghttp2-libs |
| CVE-2026-27139 | 2312557 | backend | stdlib |
| CVE-2026-27142 | 2312541 | backend | stdlib |
| CVE-2026-27145 | 2313213 | baseos | stdlib |
| CVE-2026-28387 | 2312701 | vault | libcrypto3 |
| CVE-2026-28388 | 2312705 | vault | libcrypto3 |
| CVE-2026-28389 | 2312709 | vault | libcrypto3 |
| CVE-2026-28390 | 2312713 | vault | libcrypto3 |
| CVE-2026-29181 | 2312485 | backend | go.opentelemetry.io/otel |
| CVE-2026-31789 | 2312697 | vault | libcrypto3 |
| CVE-2026-31790 | 2312733 | vault | libcrypto3 |
| CVE-2026-32280 | 2312489 | backend | stdlib |
| CVE-2026-32281 | 2312493 | backend | stdlib |
| CVE-2026-32282 | 2312545 | backend | stdlib |
| CVE-2026-32283 | 2312497 | backend | stdlib |
| CVE-2026-32287 | 2312853 | otel-collector | github.com/antchfx/xpath |
| CVE-2026-32288 | 2312549 | backend | stdlib |
| CVE-2026-32289 | 2312553 | backend | stdlib |
| CVE-2026-32952 | 2312689, 2312737 | vault, vault-unsealer | github.com/Azure/go-ntlmssp |
| CVE-2026-33811 | 2312577, 2312629, 2312777, 2312897, 2313073 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-33814 | 2312581, 2312633, 2312781, 2312901, 2313077 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-33845 | 2313117 | baseos | libgnutls30t64 |
| CVE-2026-33846 | 2313121 | baseos | libgnutls30t64 |
| CVE-2026-33997 | 2312877 | otel-collector | github.com/docker/docker |
| CVE-2026-34040 | 2312857 | otel-collector | github.com/docker/docker |
| CVE-2026-34743 | 2312437, 2313209 | baseos, postgresql | liblzma5, xz-libs |
| CVE-2026-35469 | 2312513 | backend | github.com/moby/spdystream |
| CVE-2026-3783 | 2312757 | curl | curl |
| CVE-2026-3784 | 2312761 | curl | curl |
| CVE-2026-3805 | 2312765 | curl | curl |
| CVE-2026-3832 | 2313125 | baseos | libgnutls30t64 |
| CVE-2026-3833 | 2313129 | baseos | libgnutls30t64 |
| CVE-2026-39820 | 2312585, 2312637, 2312785, 2312905, 2313081 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-39823 | 2312589, 2312641, 2312789, 2312909, 2313085 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-39825 | 2312593, 2312645, 2312793, 2312913, 2313089 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-39826 | 2312597, 2312649, 2312797, 2312917, 2313093 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-39836 | 2312601, 2312653, 2312801, 2312921, 2313097 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-39882 | 2312881 | otel-collector | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp |
| CVE-2026-40179 | 2312885 | otel-collector | github.com/prometheus/prometheus |
| CVE-2026-40200 | 2312717 | vault | musl |
| CVE-2026-41567 | 2312861 | otel-collector | github.com/docker/docker |
| CVE-2026-41568 | 2312889 | otel-collector | github.com/docker/docker |
| CVE-2026-41602 | 2312681, 2312721 | vault, vault-unsealer | github.com/apache/thrift |
| CVE-2026-41889 | 2312693, 2312745 | vault, vault-unsealer | github.com/jackc/pgx/v5 |
| CVE-2026-41989 | 2313137 | baseos | libgcrypt20 |
| CVE-2026-42009 | 2313141 | baseos | libgnutls30t64 |
| CVE-2026-42010 | 2313145 | baseos | libgnutls30t64 |
| CVE-2026-42011 | 2313149 | baseos | libgnutls30t64 |
| CVE-2026-42012 | 2313153 | baseos | libgnutls30t64 |
| CVE-2026-42013 | 2313157 | baseos | libgnutls30t64 |
| CVE-2026-42014 | 2313161 | baseos | libgnutls30t64 |
| CVE-2026-42015 | 2313165 | baseos | libgnutls30t64 |
| CVE-2026-42151 | 2312865 | otel-collector | github.com/prometheus/prometheus |
| CVE-2026-42154 | 2312869 | otel-collector | github.com/prometheus/prometheus |
| CVE-2026-42306 | 2312873 | otel-collector | github.com/docker/docker |
| CVE-2026-42499 | 2312605, 2312657, 2312805, 2312925, 2313101 | baseos, linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | stdlib |
| CVE-2026-42504 | 2313217 | baseos | stdlib |
| CVE-2026-42507 | 2313221 | baseos | stdlib |
| CVE-2026-44503 | 2312685, 2312725 | vault, vault-unsealer | github.com/microsoft/kiota-http-go |
| CVE-2026-44903 | 2312893 | otel-collector | github.com/prometheus/prometheus |
| CVE-2026-46680 | 2312609, 2312661 | linkerd-controller, linkerd-policy-controller | github.com/containerd/containerd |
| CVE-2026-5260 | 2313177 | baseos | libgnutls30t64 |
| CVE-2026-5419 | 2313181 | baseos | libgnutls30t64 |
| CVE-2026-5450 | 2312817, 2312937 | linkerd-proxy, linkerd-proxy-init | glibc |
| CVE-2026-5928 | 2312821, 2312941 | linkerd-proxy, linkerd-proxy-init | glibc |
| CVE-2026-5958 | 2313193 | baseos | sed |
| CVE-2026-6042 | 2312741 | vault | musl |
| GHSA-82J2-J2CH-GFR8 | 2312613, 2312665, 2312813, 2312933 | linkerd-controller, linkerd-policy-controller, linkerd-proxy, linkerd-proxy-init | rustls-webpki |
| GHSA-965H-392X-2MH5 | 2312829, 2312949 | linkerd-proxy, linkerd-proxy-init | rustls-webpki |
| GHSA-XGP8-3HG3-C2MH | 2312837, 2312957 | linkerd-proxy, linkerd-proxy-init | rustls-webpki |