gitlab-container-registry-18.3

Direct Vulnerabilities

Known vulnerabilities in the gitlab-container-registry-18.3 package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
L Incorrect Authorization	*
L CVE-2026-94444	*
L Incorrect Authorization	*
L Permissive Regular Expression	*
L Incorrect Authorization	*
L Server-Side Request Forgery (SSRF)	*
L Incorrect Authorization	*
L Acceptance of Extraneous Untrusted Data With Trusted Data	*
L Incorrect Authorization	*
L CVE-2026-94447	*
L Incorrect Authorization	*
L Information Exposure Through Log Files	*
L Open Redirect	*
L CVE-2026-97030	*
L CVE-2026-78663	*
L CVE-2026-94440	*
L CVE-2026-78659	*
L CVE-2026-78660	*
L CVE-2026-94439	*
L CVE-2026-78667	*
L CVE-2026-94448	*
L CVE-2026-97031	*
L CVE-2026-97032	*
L CVE-2026-56857	*
L CVE-2026-56866	*
L CVE-2026-78669	*
L CVE-2026-56851	*
L Incorrect Authorization	*
L Information Exposure	*
L Improper Validation of Array Index	*
L Improper Handling of Case Sensitivity	*
L CVE-2026-56855	*
L CVE-2026-78662	*
L Resource Exhaustion	*
L Allocation of Resources Without Limits or Throttling	*
L CVE-2026-56854	*
L Race Condition	*
L CVE-2026-56864	*
L CVE-2026-56865	*
L CVE-2026-33818	*
L CVE-2026-56853	*
L CVE-2026-56859	*
L CVE-2026-56858	*
L CVE-2026-56862	*
L CVE-2026-56860	*
L CVE-2026-56852	*
L CVE-2026-46600	*
L GHSA-hrxh-6v49-42gf	*
M Use of Incorrectly-Resolved Name or Reference	*
L Missing Authorization	*
L Cross-site Scripting (XSS)	*
L CVE-2026-42505	*
L CVE-2026-39822	*
L GO-2026-5932	*
L Uncontrolled Memory Allocation	*
M Improper Neutralization	*
L Authorization Bypass Through User-Controlled Key	*
L Incorrect Authorization	*
L Allocation of Resources Without Limits or Throttling	*
H Cross-site Scripting (XSS)	*
L Authorization Bypass Through User-Controlled Key	*
L Improper Verification of Cryptographic Signature	*
L CVE-2026-33815	*
L Deserialization of Untrusted Data	*
L CVE-2026-46595	*
L Improper Enforcement of Message Integrity During Transmission in a Communication Channel	*
L Integer Overflow or Wraparound	*
L Improper Restriction of Rendered UI Layers or Frames	*
L CVE-2026-42504	*
L Improper Certificate Validation	*
L Improper Restriction of Rendered UI Layers or Frames	*
M Loop with Unreachable Exit Condition ('Infinite Loop')	<18.3.6-r1
L Incorrect Type Conversion or Cast	*
L Missing Authorization	*
L Resource Exhaustion	*
L CVE-2026-42507	*
L Reachable Assertion	<18.3.6-r1
L Out-of-Bounds	*
L Cross-site Scripting (XSS)	*
L Improper Certificate Validation	*
L CVE-2026-39821	*
L Improper Restriction of Rendered UI Layers or Frames	*
L Missing Authorization	*
M Use of a Broken or Risky Cryptographic Algorithm	*
L Improper Certificate Validation	*
L CVE-2026-46598	*
L CVE-2026-27145	*
L Use of a Broken or Risky Cryptographic Algorithm	*
M CVE-2025-47911	<18.3.6-r1
L CVE-2026-39824	*
L Incorrect Authorization	*
L Allocation of Resources Without Limits or Throttling	*
L Use of Incorrectly-Resolved Name or Reference	*
L Allocation of Resources Without Limits or Throttling	*
L Missing Authorization	*
L CVE-2026-39825	*
M Out-of-bounds Write	*
M Link Following	*
L Improper Encoding or Escaping of Output	*
L CVE-2026-42501	*
H Double Free	*
H Allocation of Resources Without Limits or Throttling	*
L CVE-2026-42499	*
H NULL Pointer Dereference	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Cross-site Scripting (XSS)	*
L Allocation of Resources Without Limits or Throttling	*
L GHSA-j88v-2chj-qfwx	*
H Access of Resource Using Incompatible Type ('Type Confusion')	*
C CVE-2026-27143	*
L CVE-2026-33816	*
H Improper Certificate Validation	*
L CVE-2026-32280	*
H Incorrect Authorization	*
H Allocation of Resources Without Limits or Throttling	*
M Cross-site Scripting (XSS)	*
M Link Following	*
M Allocation of Resources Without Limits or Throttling	*
H Untrusted Search Path	*
L GHSA-xmrv-pmrh-hhx2	*
L Uncaught Exception	*
M Improper Handling of Length Parameter Inconsistency	*
L Incorrect Behavior Order: Validate Before Canonicalize	*
H Resource Exhaustion	*
M Interpretation Conflict	*
L Resource Exhaustion	*
H Resource Exhaustion	*
H Permissive Regular Expression	*
L Partial Comparison	*
L Permissive Regular Expression	*
H Improper Handling of Parameters	*
C Use of Externally-Controlled Format String	*
L Improper Authorization	*
L Directory Traversal	*
L Cross-site Scripting (XSS)	*
L Direct Request ('Forced Browsing')	*
L Untrusted Search Path	*
L Directory Traversal	*
L Cross-site Scripting (XSS)	*
H Allocation of Resources Without Limits or Throttling	*
M Cross-site Scripting (XSS)	*
C CVE-2025-68121	*
L Server-Side Request Forgery (SSRF)	*
L CVE-2025-61732	*
L Missing Authorization	*
L Allocation of Resources Without Limits or Throttling	*
L Allocation of Resources Without Limits or Throttling	*
L CVE-2025-61731	*
L CVE-2025-61730	*
L Out-of-bounds Write	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Incorrect Authorization	*
H Allocation of Resources Without Limits or Throttling	*
L Allocation of Resources Without Limits or Throttling	*
H Information Exposure	<18.3.4-r0
L Improper Certificate Validation	*
L Improper Certificate Validation	*
L CVE-2025-58181	<18.3.6-r1
L CVE-2025-47914	<18.3.6-r1
M Incorrect Authorization	<18.3.6-r0
M Information Exposure	<18.3.6-r0
M Uncontrolled Memory Allocation	<18.3.6-r0
L CVE-2025-58186	<18.3.4-r0
L Improper Certificate Validation	<18.3.4-r0
L CVE-2025-61725	<18.3.4-r0
L CVE-2025-58183	<18.3.4-r0
L Allocation of Resources Without Limits or Throttling	<18.3.4-r0
L Information Exposure Through Log Files	<18.3.4-r0
L Allocation of Resources Without Limits or Throttling	<18.3.4-r0
L Allocation of Resources Without Limits or Throttling	<18.3.4-r0
L CVE-2025-47912	<18.3.4-r0
L Algorithmic Complexity	<18.3.5-r0
M Information Exposure	<18.3.5-r0
L Resource Exhaustion	<18.3.5-r0
L Resource Exhaustion	<18.3.4-r0
L Resource Exhaustion	<18.3.4-r0
L Resource Exhaustion	<18.3.4-r0
L Allocation of Resources Without Limits or Throttling	<18.3.1-r0
H Allocation of Resources Without Limits or Throttling	<18.3.1-r0
L Arbitrary Code Injection	<18.3.1-r0
M Missing Authorization	<18.3.1-r0
L CVE-2024-21510	*
L Resource Exhaustion	<18.3.3-r0
L CVE-2025-47910	<18.3.2-r0

gitlab-container-registry-18.3

Direct Vulnerabilities

Fix vulnerabilities automatically