Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/treeverse/lakefs

5 known vulnerabilities (1 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 high, 4 medium
Registry
pkg.go.dev

Advisories 5

  • lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access

    Affected: fixed in 1.77.0.

  • CVE-2025-68671Medium 6.5

    lakeFS is Missing Timestamp Validation in S3 Gateway Authentication

    Affected: fixed in 1.75.0.

  • CVE-2025-64179Medium 5.3

    lakeFS: Unauthenticated access to API usage metrics

    Affected: fixed in 1.71.0.

  • CVE-2025-27100Medium 6.5

    An authenticated user can crash lakeFS by exhausting server memory

    Affected: fixed in 1.50.0.

  • CVE-2024-43784Medium 5.7

    Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion

    Affected: fixed in 1.33.0.