Skip to main content
Testkube 2.11.0 is out! Improved insights and metrics, more responsive AI chat, Gateway API support, and much more! Read More

testkube-nats-2.14.3_linux_arm64

digestsha256:2d25db533615628d58a3e1c5711cdc28df4ca33e154c4c24ba7c23bb1529f837
vulnerabilitiescritical: 0 high: 0 medium: 1 low: 0 unspecified: 4
platformlinux/arm64
size11 MB
packages32
critical: 0 high: 0 medium: 1 low: 0 busybox 1.37.0-r20 (apk)

pkg:apk/alpine/busybox@1.37.0-r20?os_name=alpine&os_version=3.22

# nats-release.dockerfile (8:8)
FROM nats:2.14.3-alpine

medium : CVE--2025--60876

Affected range<=1.37.0-r20
Fixed versionNot Fixed
EPSS Score0.291%
EPSS Percentile21st percentile
Description
critical: 0 high: 0 medium: 0 low: 0 unspecified: 2stdlib 1.26.4 (golang)

pkg:golang/stdlib@1.26.4

# nats-release.dockerfile (8:8)
FROM nats:2.14.3-alpine

unspecified : CVE--2026--42505

Affected range
>=1.26.0-0
<1.26.5
Fixed version1.26.5
EPSS Score0.382%
EPSS Percentile31st percentile
Description

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

unspecified : CVE--2026--39822

Affected range
>=1.26.0-0
<1.26.5
Fixed version1.26.5
EPSS Score0.232%
EPSS Percentile14th percentile
Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

critical: 0 high: 0 medium: 0 low: 0 unspecified: 1github.com/klauspost/compress 1.18.6 (golang)

pkg:golang/github.com/klauspost/compress@1.18.6

# nats-release.dockerfile (8:8)
FROM nats:2.14.3-alpine

unspecified : GHSA--259r--337f--4rfw

Affected range
>=1.16.0
<1.18.7
Fixed version1.18.7
Description

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

critical: 0 high: 0 medium: 0 low: 0 unspecified: 1golang.org/x/crypto 0.53.0 (golang)

pkg:golang/golang.org/x/crypto@0.53.0

# nats-release.dockerfile (8:8)
FROM nats:2.14.3-alpine

unspecified : GO--2026--5932

Affected range>=0
Fixed versionNot Fixed
Description

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.