Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Loki and Secrets‑Store CSI driver can be slowed by crafted HTML
published 23 days ago
Summary
Both the Loki logging system and the Secrets‑Store CSI driver for AWS can spend a lot of CPU when they try to read specially crafted web pages. This high CPU use can slow down or temporarily stop the service, affecting the availability of your logs or secret storage. Update to the latest versions of these components or apply the vendor’s patches to avoid the slowdown.
What to do
- Update cleanstart loki to version 3.7.1-r1.
- Update cleanstart secrets-store-csi-driver-provider-aws to version 3.1.4-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | loki |
< 3.7.1-r1 Fix: upgrade to 3.7.1-r1
|
| CleanStart | cleanstart | secrets-store-csi-driver-provider-aws |
< 3.1.4-r1 Fix: upgrade to 3.1.4-r1
|
Original advisory text
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-MN47589 · OSV
Track software like this
Free during beta