Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

kube-state-metrics-fips could be blocked by crafted SSH response

published 1 month ago
Summary

The kube-state-metrics-fips component may have its communication halted if a malicious SSH server sends unexpected reply messages. These messages fill an internal buffer and stop the software from reading new data, potentially disrupting monitoring data collection. Apply the latest update from the vendor or restrict SSH connections to trusted sources to mitigate the risk.

What to do
  • Update cleanstart kube-state-metrics-fips to version 2.18.0-r2.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart kube-state-metrics-fips < 2.18.0-r2
Fix: upgrade to 2.18.0-r2
Original advisory text
malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
Security vulnerability affects the kube-state-metrics-fips package. A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published1 Oct 2026
Updated1 Oct 2026
First seen1 Oct 2026
Sources
CLEANSTART-2026-FS18704 · OSV
Track software like this
Free during beta