steeltoeoss/security-advisories Security Advisories | GitStock

medium2026-09-17

CVE-2026-81868-Steeltoe: Header-forwarded client cert lacks proof of private-key possession

GHSA-5mq7-rwhj-4fh9

high2026-09-17

CVE-2026-81516-Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

GHSA-67c9-f6v2-qv86

high2026-09-17

CVE-2026-81515-Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

GHSA-hr73-3gpv-hh6q

medium2026-09-17

CVE-2026-75523-Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

GHSA-8phw-xrj9-cpqp

low2026-07-02

CVE-2026-50268-Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

GHSA-4j9m-h44m-2hv8

medium2026-07-02

CVE-2026-50267-Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

GHSA-rxrh-4j9h-xgg9

medium2026-07-02

CVE-2026-50202-Steeltoe's static JWKS cache shared across schemes and never invalidated

GHSA-7fqc-p256-7pwj

medium2026-07-02

CVE-2026-50201-Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

GHSA-227r-jm2g-7cp4

low2024-07-17

CVE-2024-40636-Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error

GHSA-vmcp-66r5-3pcp