Kubernetes security fix timeline
Public commits from kubernetes/kubernetes whose messages cite a vulnerability or a security fix. Patch text is not stored.
24 security-fix timeline events
Sep 25, 2026 · CVE-2026-84304
Bump google.golang.org/grpc to v1.84.0 and lift its pin
Bump google.golang.org/grpc to v1.84.0 and lift its pin v1.82.2 lacks the CVE-2026-84304 fix (grpc/grpc-go#9331, in v1.83.1+). The four modules v1.83+ adds via cloud.google.com/go/auth are graph-only (only credentials/google imports them, not vendored); record them in status.un…
Sep 25, 2026 · CVE-2026-56865
Bump golang.org/x modules and mdlayher/socket
Bump golang.org/x modules and mdlayher/socket golang.org/x/net v0.59.0, crypto v0.57.0, sys v0.48.0, term v0.46.0, text v0.42.0, sync v0.23.0, tools v0.50.0, mod v0.41.0, time v0.16.0, oauth2 v0.37.0, exp 85c1c2202aba, and github.com/mdlayher/socket v0.7.0. x/mod v0.40.0 fixed…
Sep 11, 2026 · CVE-2026-84445
deps: bump google.golang.org/grpc to v1.82.2
Merge pull request #141976 from harshitgupta31415/codex/grpc-cve-2026-84445 deps: bump google.golang.org/grpc to v1.82.2
Sep 8, 2026 · CVE-2026-78662
update golang.org/x/crypto to v0.56.0
Merge pull request #141886 from AboEl3iz/fix-cve-2026-78662 update golang.org/x/crypto to v0.56.0
Jul 20, 2026 · CVE-2026-33186
Update google.golang.org/grpc to v1.82.1
Update google.golang.org/grpc to v1.82.1 This release fixes three security issues in grpc-go. - A gRPC server now stops reading from a connection when a peer sends too many HTTP/2 control frames. Before this change, a peer could flood a server with control frames and make…
Apr 24, 2026 · CVE-2026-33814
Update golang.org/x/net to v0.53.0
Update golang.org/x/net to v0.53.0 Fixes CVE-2026-33814 (golang/go#78476): HTTP/2 Transport hangs indefinitely when a peer sends a SETTINGS frame with MaxFrameSize=0. This is reachable from kube-apiserver's OIDC, admission webhook, and aggregated API client paths.
Jan 14, 2026
Update security and stability dependencies
Update security and stability dependencies This PR updates several dependencies addressing security vulnerabilities, stability fixes, and authentication improvements. - golang.org/x/crypto: v0.46.0 -> v0.47.0 - Includes latest X509 root certificate bundle updates - Securit…
Jan 11, 2026
Update security-critical authentication and protobuf dependencies
Update security-critical authentication and protobuf dependencies This PR updates security-critical dependencies addressing authentication and data parsing vulnerabilities. **Authentication Security:** - github.com/coreos/go-oidc: v2.3.0 -> v2.5.0 - Security fix: Now verifie…
Mar 24, 2025
Mask Linux thermal interrupt info in /proc and /sys.
Mask Linux thermal interrupt info in /proc and /sys. On Linux, mask "/proc/interrupts" and "/sys/devices/system/cpu/cpu<x>/thermal_throttle" inside containers by default. Privileged containers or containers started with --security-opt="systempaths=unconfined" are not affected.…
May 8, 2024
Bump govulncheck version to 1.1.0
Bump govulncheck version to 1.1.0 This commit will bump govulncheck version 1.0.1 -> 1.1.0 Additionally, handle govulncheck exit code returned It will handle the govulncheck exit code returned which returning 3 instead of 0 with the new v1.1.0 by adding `|| true` so that the…