GoPackage

vitess.io/vitess

8 known vulnerabilities (2 critical, 1 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: v0.24.5 (Oct 13, 2026): no advisory affects it
Newest unaffected release: v2.1.1+incompatible (May 22, 2017)
Advisories: 8 · 2 critical, 1 high, 5 medium

Releases: 237 since v0.7.0 (Jul 28, 2020)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-104252
Affects v0.7.0 to v0.23.4 (v0.23.5 is outside it); v0.24.0 to v0.24.1 (v0.24.2 is outside it)
CVE-2026-65959
Affects v0.7.0 to v0.23.6 (v0.23.7 is outside it); v0.24.0-rc1 to v0.24.2 (v0.24.3 is outside it)
CVE-2026-27969
Affects v0.7.0 to v0.22.3 (v0.22.4 is outside it); v0.23.0-rc1 to v0.23.2 (v0.23.3 is outside it)
CVE-2026-27965
Affects v0.7.0 to v0.23.2 (v0.23.3 is outside it)
CVE-2024-53257
Affects v0.7.0 to v0.19.7 (v0.19.8 is outside it); v0.20.0-rc1 to v0.20.3 (v0.20.4 is outside it); v0.21.0-rc1 to v0.21.0 (v0.21.1 is outside it)
CVE-2024-32886
Affects v0.7.0 to v0.17.6 (v0.17.7 is outside it); v0.18.0 to v0.18.4 (v0.18.5 is outside it); v0.19.0 to v0.19.3 (v0.19.4 is outside it)
CVE-2023-29195
Affects v0.7.0 to v0.16.1 (v0.16.2 is outside it)
CVE-2023-29194
Affects v0.7.0 to v0.16.0 (v0.16.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-104252Critical 9.8
Vitess vttablet /twopcz reflected XSS
Affected: fixed in 0.23.5; from 0.24.0, fixed in 0.24.2; fixed in 0.23.5; from 0.24.0, fixed in 0.24.2.
Fixed in v0.23.5 (released Jun 24, 2026, 111 days before disclosure) and v0.24.2 (released Jun 24, 2026, 111 days before disclosure).
The latest release, v0.24.5, is not affected.
CVE-2026-65959Medium 5.3
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data
Affected: from 0.24.0-rc1, through 0.24.2; through 0.23.6; fixed in 0.23.6; from 0.24.0-rc1, fixed in 0.24.3.
Fixed in v0.24.3 (released Sep 3, 2026, 16 days after disclosure).
The latest release, v0.24.5, is not affected.
CVE-2026-27969Critical 9.3
Vitess users with backup storage access can write to arbitrary file paths on restore
Affected: fixed in 0.22.4; from 0.23.0-rc1, fixed in 0.23.3; from 0.23.0-rc1, fixed in 0.23.3; fixed in 0.22.4.
Fixed in v0.22.4 (released Feb 27, 2026, 1 day after disclosure) and v0.23.3 (released Feb 27, 2026, 1 day after disclosure).
The latest release, v0.24.5, is not affected.
CVE-2026-27965High 8.4
Vitess users with backup storage access can gain unauthorized access to production deployment environments
Affected: fixed in 0.22.4; from 0.23.0, fixed in 0.23.3; through 0.23.2.
Fixed in v0.23.3 (released Feb 27, 2026, 1 day after disclosure).
The latest release, v0.24.5, is not affected.
CVE-2024-53257Medium 4.9
Vitess allows HTML injection in /debug/querylogz & /debug/env
Affected: fixed in 0.19.8; from 0.20.0, fixed in 0.20.4; from 0.21.0, fixed in 0.21.1; from 0.21.0-rc1, fixed in 0.21.1; from 0.20.0-rc1, fixed in 0.20.4; fixed in 0.19.8.
Fixed in v0.19.8 (released Dec 3, 2024, the day of disclosure), v0.20.4 (released Dec 3, 2024, the day of disclosure) and v0.21.1 (released Dec 3, 2024, the day of disclosure).
The latest release, v0.24.5, is not affected.
CVE-2024-32886Medium 4.9
Vitess vulnerable to infinite memory consumption and vtgate crash
Affected: fixed in 0.17.7; from 0.18.0, fixed in 0.18.5; from 0.19.0, fixed in 0.19.4; fixed in 0.17.7; from 0.18.0, fixed in 0.18.5; from 0.19.0, fixed in 0.19.4.
Fixed in v0.17.7 (released May 8, 2024, the day of disclosure), v0.18.5 (released May 8, 2024, the day of disclosure) and v0.19.4 (released May 8, 2024, the day of disclosure).
The latest release, v0.24.5, is not affected.
CVE-2023-29195Medium 4.1
Vitess VTAdmin users that can create shards can deny access to other functions
Affected: fixed in 0.16.2.
Fixed in v0.16.2 (released May 9, 2023, 2 days before disclosure).
The latest release, v0.24.5, is not affected.
CVE-2023-29194Medium 4.1
vitess allows users to create keyspaces that can deny access to already existing keyspaces
Affected: fixed in 0.16.1.
Fixed in v0.16.1 (released Mar 30, 2023, 15 days before disclosure).
The latest release, v0.24.5, is not affected.