Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/k3s-io/k3s

3 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 high, 2 medium
Registry
pkg.go.dev

Advisories 3

  • CVE-2026-54250Medium 5.8

    K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

    Affected: all versions; from 1.35.0-rc1, fixed in 1.35.3; from 1.34.0-rc1, fixed in 1.34.6; fixed in 1.33.10.

  • CVE-2025-46599Medium 6.8

    CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some…

    Affected: all versions; from 1.32.0-rc1, fixed in 1.32.4-rc1.

  • An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers'…

    Affected: fixed in 1.24.17; from 1.25.0, fixed in 1.25.13; from 1.26.0, fixed in 1.26.8; from 1.27.0, fixed in 1.27.5; from 1.28.0, fixed in 1.28.1.