Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/amir20/dozzle

6 known vulnerabilities (3 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
v1.29.0 (Jun 23, 2020): affected by 6 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
6 · 3 high, 2 medium, 1 low
Releases
173 since v1.0.1 (Oct 30, 2018)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • CVE-2026-62286Medium 4.3

    Dozzle label filters do not restrict container event and statistics streams

    Affected: fixed in 1.29.1-0.20260622172006-19c01e0fb491.

    No fix released. The advisory names 1.29.1-0.20260622172006-19c01e0fb491 as the fix, which the registry doesn't have yet. The latest release, v1.29.0, is still affected.

  • Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

    Affected: fixed in 1.29.1-0.20260804193351-8cf7ccd5ee04.

    No fix released. The advisory names 1.29.1-0.20260804193351-8cf7ccd5ee04 as the fix, which the registry doesn't have yet. The latest release, v1.29.0, is still affected.

  • Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

    Affected: through 8.14.12; all versions.

    No fix released. The latest release, v1.29.0, is still affected.

  • Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication

    Affected: all versions; through 10.5.1.

    No fix released. The latest release, v1.29.0, is still affected.

  • Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access

    Affected: fixed in 1.29.1-0.20260125230338-620e59aa2463.

    No fix released. The advisory names 1.29.1-0.20260125230338-620e59aa2463 as the fix, which the registry doesn't have yet. The latest release, v1.29.0, is still affected.

  • CVE-2024-47182Medium 4.8

    Dozzle uses unsafe hash for passwords

    Affected: all versions; fixed in 8.5.3.

    No fix released. The latest release, v1.29.0, is still affected.