CGA-3RV7-4634-JP9C: crossplane-provider-aws-cloudformation
CVSS: UnknownUnknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-3RV7-4634-JP9C is a vulnerability in crossplane-provider-aws-cloudformation with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard200 products
- commercial-grafana-12.4< 12.4.10-r0
- commercial-grafana-13.0< 13.0.8-r0
- commercial-grafana-13.1< 13.1.2-r0
- crossplane-2.3-crank< 2.3.4-r1
- crossplane-aws-glacier-fips< 2.6.0-r4
- crossplane-aws-monolith< 2.6.0-r5
- crossplane-aws-monolith-fips< 2.6.0-r6
- crossplane-aws-xray-fips< 2.6.0-r5
- crossplane-fips-2.3-crank< 2.3.4-r2
- crossplane-provider-aws-accessanalyzer< 2.6.0-r5
- crossplane-provider-aws-accessanalyzer-fips< 2.6.0-r5
- crossplane-provider-aws-account< 2.6.0-r5
- crossplane-provider-aws-account-fips< 2.6.0-r6
- crossplane-provider-aws-acm< 2.6.0-r6
- crossplane-provider-aws-acm-fips< 2.6.0-r7
- crossplane-provider-aws-acmpca< 2.6.0-r5
- crossplane-provider-aws-acmpca-fips< 2.6.0-r5
- crossplane-provider-aws-amp< 2.6.0-r5
- crossplane-provider-aws-amp-fips< 2.6.0-r6
- crossplane-provider-aws-amplify< 2.6.0-r4
- crossplane-provider-aws-amplify-fips< 2.6.0-r5
- crossplane-provider-aws-apigateway< 2.6.0-r6
- crossplane-provider-aws-apigateway-fips< 2.6.0-r5
- crossplane-provider-aws-apigatewayv2< 2.6.0-r5
- crossplane-provider-aws-apigatewayv2-fips< 2.6.0-r5
- crossplane-provider-aws-appautoscaling< 2.6.0-r5
- crossplane-provider-aws-appautoscaling-fips< 2.6.0-r5
- crossplane-provider-aws-appconfig< 2.6.0-r5
- crossplane-provider-aws-appconfig-fips< 2.6.0-r6
- crossplane-provider-aws-appflow< 2.6.0-r7
- crossplane-provider-aws-appflow-fips< 2.6.0-r9
- crossplane-provider-aws-appintegrations< 2.6.0-r6
- crossplane-provider-aws-appintegrations-fips< 2.6.0-r5
- crossplane-provider-aws-applicationinsights< 2.6.0-r6
- crossplane-provider-aws-applicationinsights-fips< 2.6.0-r6
- crossplane-provider-aws-appmesh< 2.6.0-r4
- crossplane-provider-aws-appmesh-fips< 2.6.0-r4
- crossplane-provider-aws-apprunner< 2.6.0-r5
- crossplane-provider-aws-apprunner-fips< 2.6.0-r6
- crossplane-provider-aws-appstream< 2.6.0-r5
- crossplane-provider-aws-appstream-fips< 2.6.0-r5
- crossplane-provider-aws-appsync< 2.6.0-r5
- crossplane-provider-aws-appsync-fips< 2.6.0-r3
- crossplane-provider-aws-athena< 2.6.0-r6
- crossplane-provider-aws-athena-fips< 2.6.0-r8
- crossplane-provider-aws-autoscaling< 2.6.0-r7
- crossplane-provider-aws-autoscaling-fips< 2.6.0-r7
- crossplane-provider-aws-autoscalingplans< 2.6.0-r4
- crossplane-provider-aws-autoscalingplans-fips< 2.6.0-r5
- crossplane-provider-aws-backup< 2.6.0-r8
- crossplane-provider-aws-backup-fips< 2.6.0-r6
- crossplane-provider-aws-batch< 2.6.0-r5
- crossplane-provider-aws-batch-fips< 2.6.0-r5
- crossplane-provider-aws-bedrock< 2.6.0-r5
- crossplane-provider-aws-bedrock-fips< 2.6.0-r6
- crossplane-provider-aws-bedrockagent< 2.6.0-r6
- crossplane-provider-aws-bedrockagent-fips< 2.6.0-r7
- crossplane-provider-aws-bedrockagentcore< 2.6.0-r3
- crossplane-provider-aws-budgets< 2.6.0-r3
- crossplane-provider-aws-budgets-fips< 2.6.0-r5
- crossplane-provider-aws-ce< 2.6.0-r3
- crossplane-provider-aws-ce-fips< 2.6.0-r3
- crossplane-provider-aws-chime< 2.6.0-r6
- crossplane-provider-aws-chime-fips< 2.6.0-r7
- crossplane-provider-aws-cloud9< 2.6.0-r4
- crossplane-provider-aws-cloud9-fips< 2.6.0-r6
- crossplane-provider-aws-cloudcontrol< 2.6.0-r7
- crossplane-provider-aws-cloudcontrol-fips< 2.6.0-r4
- crossplane-provider-aws-cloudformation< 2.6.0-r7
- crossplane-provider-aws-cloudformation-fips< 2.6.0-r7
- crossplane-provider-aws-cloudfront< 2.6.0-r5
- crossplane-provider-aws-cloudfront-fips< 2.6.0-r7
- crossplane-provider-aws-cloudsearch< 2.6.0-r7
- crossplane-provider-aws-cloudsearch-fips< 2.6.0-r7
- crossplane-provider-aws-cloudtrail< 2.6.0-r7
- crossplane-provider-aws-cloudtrail-fips< 2.6.0-r7
- crossplane-provider-aws-cloudwatch< 2.6.0-r7
- crossplane-provider-aws-cloudwatch-fips< 2.6.0-r7
- crossplane-provider-aws-cloudwatchevents< 2.6.0-r7
- crossplane-provider-aws-cloudwatchevents-fips< 2.6.0-r8
- crossplane-provider-aws-cloudwatchlogs< 2.6.0-r7
- crossplane-provider-aws-cloudwatchlogs-fips< 2.6.0-r9
- crossplane-provider-aws-codeartifact< 2.6.0-r5
- crossplane-provider-aws-codeartifact-fips< 2.6.0-r6
- crossplane-provider-aws-codecommit< 2.6.0-r5
- crossplane-provider-aws-codecommit-fips< 2.6.0-r5
- crossplane-provider-aws-codeguruprofiler< 2.6.0-r2
- crossplane-provider-aws-codeguruprofiler-fips< 2.6.0-r4
- crossplane-provider-aws-codepipeline< 2.6.0-r6
- crossplane-provider-aws-codepipeline-fips< 2.6.0-r5
- crossplane-provider-aws-codestarconnections< 2.6.0-r5
- crossplane-provider-aws-codestarconnections-fips< 2.6.0-r7
- crossplane-provider-aws-codestarnotifications< 2.6.0-r6
- crossplane-provider-aws-codestarnotifications-fips< 2.6.0-r2
- crossplane-provider-aws-cognitoidentity< 2.6.0-r7
- crossplane-provider-aws-cognitoidentity-fips< 2.6.0-r6
- crossplane-provider-aws-cognitoidp< 2.6.0-r7
- crossplane-provider-aws-cognitoidp-fips< 2.6.0-r5
- crossplane-provider-aws-configservice< 2.6.0-r4
- crossplane-provider-aws-configservice-fips< 2.6.0-r4
- crossplane-provider-aws-connect< 2.6.0-r5
- crossplane-provider-aws-connect-fips< 2.6.0-r5
- crossplane-provider-aws-cur< 2.6.0-r4
- crossplane-provider-aws-cur-fips< 2.6.0-r6
- crossplane-provider-aws-dataexchange< 2.6.0-r5
- crossplane-provider-aws-dataexchange-fips< 2.6.0-r6
- crossplane-provider-aws-datapipeline< 2.6.0-r6
- crossplane-provider-aws-datapipeline-fips< 2.6.0-r7
- crossplane-provider-aws-datasync< 2.6.0-r4
- crossplane-provider-aws-datasync-fips< 2.6.0-r9
- crossplane-provider-aws-dax< 2.6.0-r4
- crossplane-provider-aws-dax-fips< 2.6.0-r6
- crossplane-provider-aws-deploy< 2.6.0-r6
- crossplane-provider-aws-deploy-fips< 2.6.0-r5
- crossplane-provider-aws-detective< 2.6.0-r6
- crossplane-provider-aws-detective-fips< 2.6.0-r6
- crossplane-provider-aws-devicefarm< 2.6.0-r5
- crossplane-provider-aws-devicefarm-fips< 2.6.0-r6
- crossplane-provider-aws-directconnect< 2.6.0-r5
- crossplane-provider-aws-directconnect-fips< 2.6.0-r5
- crossplane-provider-aws-dlm< 2.6.0-r5
- crossplane-provider-aws-dlm-fips< 2.6.0-r5
- crossplane-provider-aws-dms< 2.6.0-r4
- crossplane-provider-aws-dms-fips< 2.6.0-r6
- crossplane-provider-aws-docdb< 2.6.0-r5
- crossplane-provider-aws-docdb-fips< 2.6.0-r3
- crossplane-provider-aws-ds< 2.6.0-r4
- crossplane-provider-aws-ds-fips< 2.6.0-r5
- crossplane-provider-aws-dsql< 2.6.0-r7
- crossplane-provider-aws-dsql-fips< 2.6.0-r6
- crossplane-provider-aws-dynamodb< 2.6.0-r6
- crossplane-provider-aws-dynamodb-fips< 2.6.0-r6
- crossplane-provider-aws-ec2< 2.6.0-r6
- crossplane-provider-aws-ec2-fips< 2.6.0-r7
- crossplane-provider-aws-ecr< 2.6.0-r7
- crossplane-provider-aws-ecr-fips< 2.6.0-r6
- crossplane-provider-aws-ecrpublic< 2.6.0-r5
- crossplane-provider-aws-ecrpublic-fips< 2.6.0-r5
- crossplane-provider-aws-ecs< 2.6.0-r9
- crossplane-provider-aws-ecs-fips< 2.6.0-r8
- crossplane-provider-aws-efs< 2.6.0-r6
- crossplane-provider-aws-efs-fips< 2.6.0-r7
- crossplane-provider-aws-eks< 2.6.0-r7
- crossplane-provider-aws-eks-fips< 2.6.0-r8
- crossplane-provider-aws-elasticache< 2.6.0-r7
- crossplane-provider-aws-elasticache-fips< 2.6.0-r6
- crossplane-provider-aws-elasticbeanstalk< 2.6.0-r4
- crossplane-provider-aws-elasticbeanstalk-fips< 2.6.0-r3
- crossplane-provider-aws-elasticsearch< 2.6.0-r6
- crossplane-provider-aws-elasticsearch-fips< 2.6.0-r9
- crossplane-provider-aws-elastictranscoder< 2.6.0-r5
- crossplane-provider-aws-elastictranscoder-fips< 2.6.0-r7
- crossplane-provider-aws-elb< 2.6.0-r8
- crossplane-provider-aws-elb-fips< 2.6.0-r8
- crossplane-provider-aws-elbv2< 2.6.0-r6
- crossplane-provider-aws-elbv2-fips< 2.6.0-r6
- crossplane-provider-aws-emr< 2.6.0-r6
- crossplane-provider-aws-emr-fips< 2.6.0-r6
- crossplane-provider-aws-emrserverless< 2.6.0-r7
- crossplane-provider-aws-emrserverless-fips< 2.6.0-r7
- crossplane-provider-aws-evidently< 2.6.0-r7
- crossplane-provider-aws-evidently-fips< 2.6.0-r8
- crossplane-provider-aws-firehose< 2.6.0-r7
- crossplane-provider-aws-firehose-fips< 2.6.0-r6
- crossplane-provider-aws-fis< 2.6.0-r3
- crossplane-provider-aws-fis-fips< 2.6.0-r3
- crossplane-provider-aws-fsx< 2.6.0-r2
- crossplane-provider-aws-fsx-fips< 2.6.0-r4
- crossplane-provider-aws-gamelift< 2.6.0-r6
- crossplane-provider-aws-gamelift-fips< 2.6.0-r5
- crossplane-provider-aws-glacier< 2.6.0-r5
- crossplane-provider-aws-glacier-fips< 2.6.0-r3
- crossplane-provider-aws-globalaccelerator< 2.6.0-r5
- crossplane-provider-aws-globalaccelerator-fips< 2.6.0-r5
- crossplane-provider-aws-glue< 2.6.0-r5
- crossplane-provider-aws-glue-fips< 2.6.0-r7
- crossplane-provider-aws-grafana< 2.6.0-r4
- crossplane-provider-aws-grafana-fips< 2.6.0-r6
- crossplane-provider-aws-guardduty< 2.6.0-r6
- crossplane-provider-aws-guardduty-fips< 2.6.0-r6
- crossplane-provider-aws-iam< 2.6.0-r8
- crossplane-provider-aws-iam-fips< 2.6.0-r8
- crossplane-provider-aws-identitystore< 2.6.0-r6
- crossplane-provider-aws-identitystore-fips< 2.6.0-r7
- crossplane-provider-aws-imagebuilder< 2.6.0-r6
- crossplane-provider-aws-imagebuilder-fips< 2.6.0-r5
- crossplane-provider-aws-inspector< 2.6.0-r5
- crossplane-provider-aws-inspector-fips< 2.6.0-r3
- crossplane-provider-aws-inspector2< 2.6.0-r5
- crossplane-provider-aws-inspector2-fips< 2.6.0-r5
- crossplane-provider-aws-iot< 2.6.0-r5
- crossplane-provider-aws-iot-fips< 2.6.0-r7
- crossplane-provider-aws-ivs< 2.6.0-r3
- crossplane-provider-aws-ivs-fips< 2.6.0-r3
- crossplane-provider-aws-kafka< 2.6.0-r7
- crossplane-provider-aws-kafka-fips< 2.6.0-r6
- crossplane-provider-aws-kafkaconnect< 2.6.0-r7
- crossplane-provider-aws-kafkaconnect-fips< 2.6.0-r6
- crossplane-provider-aws-kendra< 2.6.0-r6
- crossplane-provider-aws-kendra-fips< 2.6.0-r8
1 vendor · 200 products · Showing 200 of 473. Use Open JSON for the complete list.
References
0 linksNo references have been published for this record.
Related vulnerabilities
CVE-2026-100354chainguardcommercial-grafana-11.6+4820.43%kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.CVE-2026-100353chainguardcommercial-grafana-12.4+4740.34%kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic nil-pointer panic through an array query parameter, a deepObject query parameter containing an array property, or an application/x-www-form-urlencoded request body whose array property appears inside an allOf, anyOf, or oneOf subschema. The query and composed-body paths reach urlValuesDecoder.parseArray, while the deepObject path reaches buildResObj, and all pass a nil items schema into code that dereferences it. This issue is fixed in version 0.149.0.CVE-2026-100348chainguardcommercial-grafana-11.6+4720.37%kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved additionalProperties schemas and ordinary recursive schemas do not take the vulnerable nil-value path. This issue is fixed in version 0.145.0.CVE-2026-100347chainguardcommercial-grafana-11.6+4720.52%kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth. The specific panic requires an exact static path; a concrete path matched only by a templated route does not reach the same sink. This issue is fixed in version 0.145.0.CVE-2026-100351chainguardcommercial-grafana-13.1+4590.49%kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.CVE-2026-100349chainguardcommercial-grafana-11.6+230.37%kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.