skopeo-tests (AlmaLinux:9) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:9 package skopeo-tests, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (39)

• CVE-2025-68121 — CVSS 10.0 (critical): During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake…
• CVE-2023-24538 — CVSS 9.8 (critical): Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used…
• CVE-2023-24540 — CVSS 9.8 (critical): Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the…
• CVE-2025-22871 — CVSS 9.1 (critical): The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling…
• CVE-2024-3727 — CVSS 8.3 (high): A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry…
• CVE-2023-24534 — CVSS 7.5 (high): HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of…
• CVE-2023-24536 — CVSS 7.5 (high): Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This…
• CVE-2023-24537 — CVSS 7.5 (high): Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite…
• CVE-2026-32283 — CVSS 7.5 (high): If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock…
• CVE-2021-33198 — CVSS 7.5 (high): In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText…
• CVE-2022-41723 — CVSS 7.5 (high): A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service…
• CVE-2022-41724 — CVSS 7.5 (high): Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers…
• CVE-2022-41725 — CVSS 7.5 (high): A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with…
• CVE-2023-39321 — CVSS 7.5 (high): Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
• CVE-2023-39322 — CVSS 7.5 (high): QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC…
• CVE-2023-45287 — CVSS 7.5 (high): Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent…
• CVE-2024-1394 — CVSS 7.5 (high): A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using…
• CVE-2024-24786 — CVSS 7.5 (high): The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when…
• CVE-2024-24791 — CVSS 7.5 (high): The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a…
• CVE-2024-34156 — CVSS 7.5 (high): Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up…
• CVE-2025-61726 — CVSS 7.5 (high): The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs…
• CVE-2025-61729 — CVSS 7.5 (high): Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out…
• CVE-2026-32280 — CVSS 7.5 (high): During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed…
• CVE-2026-32281 — CVSS 7.5 (high): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of…
• CVE-2023-24539 — CVSS 7.3 (high): Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions…
• CVE-2023-29400 — CVSS 7.3 (high): Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected…
• CVE-2025-27144: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web…
• CVE-2023-29406 — CVSS 6.5 (medium): The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers…
• CVE-2021-20291 — CVSS 6.5 (medium): A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each…
• CVE-2023-39318 — CVSS 6.1 (medium): The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts…
• CVE-2023-39319 — CVSS 6.1 (medium): The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals…
• CVE-2024-6104 — CVSS 6.0 (medium): go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing…
• CVE-2024-24783 — CVSS 5.9 (medium): Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic…
• CVE-2024-24788 — CVSS 5.9 (medium): A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
• CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…
• CVE-2023-39326 — CVSS 5.3 (medium): A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from…
• CVE-2022-41717 — CVSS 5.3 (medium): An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP…
• CVE-2025-58183 — CVSS 4.3 (medium): tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted…
• CVE-2022-30629 — CVSS 3.1 (low): Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe…