GO-2024-3219None▾ Sunlitgithub.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
github.com/crossplane/crossplane >= 1.17.1, < 1.17.2Upgrade to a patched release:
github.com/crossplane/crossplane 1.17.2Connected by shared product, vendor, weakness, or advisory.
GHSA-7h65-4p22-39j6Critical· 9.8github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2023-37900Low· 3.4Denial of service from large image
GO-2026-6302NoneSignature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
GHSA-mf7q-r4rv-jv94HighCrossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…
GHSA-wfqx-gjrf-g28rCritical· 9.0Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag