CVE-2026-46597

Description

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.47%• Percentile: 40%

Techniques & Countermeasures

• CWE-704•Incorrect Type Conversion or Cast

  The product does not correctly convert an object, resource, or structure from one type to a different type.

Affected Systems

• chainguard•aactl

  < 0.4.12-r53

• chainguard•act

  < 0.2.88-r6

• chainguard•actions-runner-controller

  < 0

• chainguard•actions-runner-controller-fips

  < 0

• chainguard•age

  < 0

• chainguard•age-fips

  < 0 | < 1.3.1-r11

• chainguard•agentbeat

  < 9.2.7-r11

• chainguard•agentbeat-fips

  < 9.2.7-r10

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent

  < 0

• chainguard•amazon-cloudwatch-agent-fips

  < 0

• chainguard•amazon-cloudwatch-agent-operator

  < 0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 0

• chainguard•amazon-ssm-agent

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec

  < 3.3.4515.0-r2

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 3.3.4515.0-r3

• chainguard•amazon-ssm-agent-fips

  < 3.3.4515.0-r3

• chainguard•apache-exporter

  < 0

• chainguard•apko

  < 1.2.14-r2

• chainguard•apko-fips

  < 1.2.14-r2

• chainguard•apm-server-8.19

  < 0

• chainguard•apm-server-9.1

  all

• chainguard•apm-server-9.3

  < 0

• chainguard•apm-server-9.4

  < 0

• chainguard•apply-cve-bump

  < 0.2.280-r0

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-3.1

  < 3.1.16-r3

• chainguard•argo-cd-3.1-compat

  < 3.1.16-r3

• chainguard•argo-cd-3.3-compat

  all

• chainguard•argo-cd-3.4

  < 3.4.2-r4

• chainguard•argo-cd-3.4-compat

  < 3.4.2-r4

• chainguard•argo-cd-fips-3.0

  all

• chainguard•argo-cd-fips-3.0-compat

  all

• chainguard•argo-cd-fips-3.1

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.1-compat

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.2

  < 3.2.12-r5

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.12-r5

• chainguard•argo-cd-fips-3.4

  < 3.4.2-r4

• chainguard•argo-cd-fips-3.4-compat

  < 3.4.2-r4

• chainguard•argo-events

  < 1.9.10-r24

• chainguard•argo-events-fips

  < 1.9.10-r17

• chainguard•argo-rollouts

  < 0

• chainguard•argo-workflow-controller-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-controller-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflow-executor-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-executor-fips-3.6

  < 3.6.19-r9

• chainguard•argo-workflows-3.6

  < 3.6.19-r7

• chainguard•argo-workflows-fips-3.6

  < 3.6.19-r9

• chainguard•argocd-image-updater

  < 1.2.1-r2

Showing first 50 affected entries in server-rendered view.

References (11)

• https://go.dev/issue/79561
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781620
• https://pkg.go.dev/vuln/GO-2026-5013
• https://nvd.nist.gov/vuln/detail/CVE-2026-46597
• https://cs.opensource.google/go/x/crypto
• https://security-tracker.debian.org/tracker/CVE-2026-46597
• https://ubuntu.com/security/CVE-2026-46597
• https://www.cve.org/CVERecord?id=CVE-2026-46597
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46597.json