Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
kubernetes-csi-external-snapshotter and opa-fips may stall with many certificates
published 9 days ago
Summary
Both the snapshotter and OPA packages can be asked to verify a very large list of intermediate certificates. When this happens they may spend excessive time processing, which can slow down or temporarily stop the service. Apply the available updates or configure the system to limit the number of certificates passed for verification.
What to do
- Update cleanstart kubernetes-csi-external-snapshotter to version 8.7.0-r0.
- Update cleanstart opa-fips to version 1.21.2-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | kubernetes-csi-external-snapshotter |
< 8.7.0-r0 Fix: upgrade to 8.7.0-r0
|
| CleanStart | cleanstart | opa-fips |
< 1.21.2-r0 Fix: upgrade to 1.21.2-r0
|
Original advisory text
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions
CVE-2026-32280 affects multiple packages. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CLEANSTART-2026-HN25684 · OSV
Track software like this
Free during beta