CGA-PFFX-8C7Q-P732: katib-earlystopping
Unknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-PFFX-8C7Q-P732 is a vulnerability in katib-earlystopping with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Chainguard90 products
- arangodb-3.11< 3.11.14.4-r3
- arangodb-3.12< 3.12.9.4-r24
- authentik-2026.2< 2026.2.4-r11
- authentik-2026.5< 2026.5.3-r5
- authentik-fips-2026.2< 2026.2.4-r10
- authentik-fips-2026.5< 2026.5.3-r4
- drupal-11.3< 11.3.13-r3
- gitlab-rails-ce-19.3< 19.3.1-r6
- gitlab-rails-ce-fips-19.3< 19.3.1-r3
- homepage< 1.13.2-r1
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- kibana-8.17< 8.17.10-r22
- kibana-8.17-bitnami< 8.17.10-r22
- kibana-8.17-iamguarded< 8.17.10-r22
- langfuse-2-worker< 2.95.12-r24
- langfuse-fips-2-worker< 2.95.12-r26
- lerna< 9.0.7-r6
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-dashboards-maps< 2.19.5-r13
- opensearch-dashboards-2-dashboards-notifications< 2.19.5-r13
- opensearch-dashboards-2-dashboards-observability< 2.19.5-r13
- opensearch-dashboards-2-dashboards-query-workbench< 2.19.5-r13
- opensearch-dashboards-2-dashboards-reporting< 2.19.5-r13
- opensearch-dashboards-2-dashboards-search-relevance< 2.19.5-r13
- opensearch-dashboards-2-dashboards-visualizations< 2.19.5-r13
- opensearch-dashboards-2-fips-alerting-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-fips-dashboards-maps< 2.19.5-r13
- opensearch-dashboards-2-fips-dashboards-notifications< 2.19.5-r13
- opensearch-dashboards-2-fips-dashboards-observability< 2.19.5-r13
- opensearch-dashboards-2-fips-dashboards-query-workbench< 2.19.5-r13
- opensearch-dashboards-2-fips-dashboards-reporting< 2.19.5-r13
- opensearch-dashboards-2-fips-dashboards-search-relevance< 2.19.5-r13
- opensearch-dashboards-2-fips-dashboards-visualizations< 2.19.5-r13
- opensearch-dashboards-2-fips-index-management-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-fips-ml-commons-dashboards< 2.19.5-r13
- opensearch-dashboards-2-fips-security-analytics-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-fips-security-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-index-management-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-ml-commons-dashboards< 2.19.5-r13
- opensearch-dashboards-2-security-analytics-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-2-security-dashboards-plugin< 2.19.5-r13
- opensearch-dashboards-3< 3.6.0-r5
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-dashboards-maps< 3.6.0-r5
- opensearch-dashboards-3-dashboards-notifications< 3.6.0-r5
- opensearch-dashboards-3-dashboards-observability< 3.6.0-r5
- opensearch-dashboards-3-dashboards-query-workbench< 3.6.0-r5
- opensearch-dashboards-3-dashboards-reporting< 3.6.0-r5
- opensearch-dashboards-3-dashboards-search-relevance< 3.6.0-r5
- opensearch-dashboards-3-fips< 3.6.0-r7
- opensearch-dashboards-3-fips-alerting-dashboards-plugin< 3.6.0-r7
- opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin< 3.6.0-r7
- opensearch-dashboards-3-fips-dashboards-maps< 3.6.0-r7
- opensearch-dashboards-3-fips-dashboards-notifications< 3.6.0-r7
- opensearch-dashboards-3-fips-dashboards-observability< 3.6.0-r7
- opensearch-dashboards-3-fips-dashboards-query-workbench< 3.6.0-r7
- opensearch-dashboards-3-fips-dashboards-reporting< 3.6.0-r7
- opensearch-dashboards-3-fips-dashboards-search-relevance< 3.6.0-r7
- opensearch-dashboards-3-fips-index-management-dashboards-plugin< 3.6.0-r7
- opensearch-dashboards-3-fips-ml-commons-dashboards< 3.6.0-r7
- opensearch-dashboards-3-fips-security-analytics-dashboards-plugin< 3.6.0-r7
- opensearch-dashboards-3-fips-security-dashboards-plugin< 3.6.0-r7
- opensearch-dashboards-3-index-management-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-ml-commons-dashboards< 3.6.0-r5
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-security-dashboards-plugin< 3.6.0-r5
- prism< 5.15.10-r2
- pulumi-language-nodejs< 3.244.0-r0
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-jupyterlab< 4.6.1-r1
- renovate< 43.170.15-r3
- saf< 1.6.0-r0
- tensorflow-cpu-jupyter< 2.21.0-r8
- tensorflow-gpu-jupyterAll versions (No fix recorded)
- vitess-23< 23.0.4-r5
- wazuh-dashboard-dashboards-reporting< 4.14.5-r3
- wazuh-dashboard-dashboards-reporting-fips< 4.14.5-r3
Wolfi32 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31
- katib-suggestion-nas-darts< 0.19.0-r31
- katib-suggestion-nas-enas< 0.19.0-r31
- katib-suggestion-optuna-enas< 0.19.0-r31
- katib-suggestion-pbt-enas< 0.19.0-r31
- katib-suggestion-skopt-enas< 0.19.0-r31
- katib-tfevent-metricscollector< 0.19.0-r31
- lerna< 9.0.7-r6
- opensearch-dashboards-3< 3.6.0-r5
- opensearch-dashboards-3-alerting-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-anomaly-detection-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-dashboards-maps< 3.6.0-r5
- opensearch-dashboards-3-dashboards-notifications< 3.6.0-r5
- opensearch-dashboards-3-dashboards-observability< 3.6.0-r5
- opensearch-dashboards-3-dashboards-query-workbench< 3.6.0-r5
- opensearch-dashboards-3-dashboards-reporting< 3.6.0-r5
- opensearch-dashboards-3-dashboards-search-relevance< 3.6.0-r5
- opensearch-dashboards-3-index-management-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-ml-commons-dashboards< 3.6.0-r5
- opensearch-dashboards-3-security-analytics-dashboards-plugin< 3.6.0-r5
- opensearch-dashboards-3-security-dashboards-plugin< 3.6.0-r5
- prism< 5.15.10-r2
- pulumi-language-nodejs< 3.244.0-r0
- py3.10-jupyterlab< 4.6.1-r1
- py3.11-jupyterlab< 4.6.1-r1
- py3.12-jupyterlab< 4.6.1-r1
- py3.13-jupyterlab< 4.6.1-r1
- renovate< 43.170.15-r3
- saf< 1.6.0-r0
- vitess-23< 23.0.4-r5
2 vendors · 122 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
RoutineCVE-2026-104874aio-libs · multidict +28 moreMultidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionMultidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.CVSS5.3MediumEPSS0.45%PrioritiseCVE-2026-102422chainguard · arangodb-3.12 +29 moreshell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` tokenshell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (for example `http://example.com/#frag`), so callers that combine `parse()` output with another untrusted string, such as `quote(parse(untrustedCommand).concat(untrustedArg))`, are affected. The fix for CVE-2026-9277 rejected line terminators in the comment's own text, but not in the tokens after it. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.CVSS9.2CriticalEPSS0.38%PrioritiseCVE-2026-102278juliangruber · brace-expansion +156 morebrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.CVSS7.5HighEPSS0.49%RoutineCVE-2026-102277juliangruber · brace-expansion +129 morebrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.CVSS5.3MediumEPSS0.43%PrioritiseCVE-2026-102276juliangruber · brace-expansion +130 morebrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.CVSS7.5HighEPSS0.46%PrioritiseCVE-2026-90711proxy-addr +70 moreproxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetproxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.CVSS9.1CriticalEPSS0.26%