Snyk test report
- ghcr.io/dexidp/dex:v2.45.0/dexidp/dex (apk)
- ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5//usr/local/bin/gomplate (gomodules)
- ghcr.io/dexidp/dex:v2.45.0/dexidp/dex//usr/local/bin/docker-entrypoint (gomodules)
- ghcr.io/dexidp/dex:v2.45.0/dexidp/dex//usr/local/bin/dex (gomodules)
Out-of-bounds Write
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Alpine.
See How to fix? for Alpine:3.23 relevant fixed versions and status.
zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.
Remediation
Upgrade Alpine:3.23 zlib to version 1.3.2-r0 or higher.
References
- https://github.com/madler/zlib
- https://seclists.org/fulldisclosure/2026/Jan/3
- https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname
- https://zlib.net/
- https://github.com/madler/zlib/issues/1142
Untrusted Search Path
Detailed paths
Overview
Affected versions of this package are vulnerable to Untrusted Search Path in resource detection code which executes ioreg, when the PATH environment variable is modified to include a malicious executable. An attacker can execute arbitrary code within the context of the application by placing a malicious binary earlier in the search path.
Note: This vulnerability is only exploitable on MacOS/Darwin systems.
Remediation
Upgrade go.opentelemetry.io/otel/sdk/resource to version 1.40.0 or higher.
References
Improper Validation of Specified Quantity in Input
Detailed paths
NVD Description
Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Alpine.
See How to fix? for Alpine:3.23 relevant fixed versions and status.
zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
Remediation
Upgrade Alpine:3.23 zlib to version 1.3.2-r0 or higher.
References
- https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/
- https://github.com/madler/zlib/issues/904
- https://github.com/madler/zlib/releases/tag/v1.3.2
- https://ostif.org/zlib-audit-complete/
- https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf
Uncaught Exception
Detailed paths
Overview
golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.
Affected versions of this package are vulnerable to Uncaught Exception due to missing nil check. An attacker can cause the server to panic and potentially disrupt service by sending specially crafted HTTP/2 frames with values between 0x0a and 0x0f.
Remediation
Upgrade golang.org/x/net/http2 to version 0.51.0 or higher.
References
Improper Validation of Integrity Check Value
Detailed paths
Overview
Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value for .idx and .pack files. An attacker can cause the application to consume corrupted files, leading to unexpected errors, due to checksums not being checked in the loadIdxFile() function.
Workaround
This vulnerability can be mitigated by running 'git fsck' from the git CLI to check for data corruption on a given repository.
Remediation
Upgrade github.com/go-git/go-git/v5/storage/filesystem to version 5.16.5 or higher.