PatchFirst · Latest vulnerabilities
Vulnerability published for aws-iam-authenticator in the last 30 days: 1. Listed in the KEV catalogue: 0.
Vulnerabilities: 3
This update for aws-iam-authenticator fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272130). - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285302). Changes for aws-iam-authenticator: - Updated to version 0.7.22
This update for aws-iam-authenticator fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266651). Changes for aws-iam-authenticator: - Update golang.org/x/net to v0.57.0.
This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass (bsc#1200528). - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395). - CVE-2024-39689: remove root certificates from `GLOBALTRUST` from the root store. - CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265842). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266
Check your installed stack and versions against the current vulnerability feeds.