Homepage

Improper Validation of Integrity Check Value The advisory has been revoked - it doesn't affect any version of package kyverno-reports-controller-1.15  (opens in a new tab)

Threat Intelligence

EPSS
0.14% (4th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KYVERNOREPORTSCONTROLLER115-15308844
  • published19 Feb 2026
  • disclosed9 Feb 2026
Report a new vulnerability Found a mistake?

Introduced: 9 Feb 2026

CVE-2026-25934  (opens in a new tab)
CWE-354  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kyverno-reports-controller-1.15 package and not the kyverno-reports-controller-1.15 package as distributed by Minimos.

go-git is a highly extensible git implementation library written in pure Go. Prior to 5.16.5, a vulnerability was discovered in go-git whereby data integrity values for .pack and .idx files were not properly verified. This resulted in go-git potentially consuming corrupted files, which would likely result in unexpected errors such as object not found. For context, clients fetch packfiles from upstream Git servers. Those files contain a checksum of their contents, so that clients can perform integrity checks before consuming it. The pack indexes (.idx) are generated locally by go-git, or the git cli, when new .pack files are received and processed. The integrity checks for both files were not being verified correctly. This vulnerability is fixed in 5.16.5.