Kustomize traverses a Kubernetes manifest to add, remove or update configuration options without forking.

Kustomize

kustomize:5.8.1-23.21

bash

bash-sh

ca-certificates-mozilla-prebuilt

coreutils

crypto-policies

filesystem

git-2

glibc

gpg-pubkey

gpg2

helm-3

info

krb5

kustomize-5

libacl1

libassuan0

libattr1

libbrotlicommon1

libbrotlidec1

libbz2-1

libcap2

libcbor0_10

libcom_err2

libcrypt1

libcurl4

libedit0

libexpat1

libfido2-1

libgcc_s1

libgcrypt20

libgmp10

libgpg-error0

libhidapi-hidraw0

libidn2-0

libjitterentropy3

libkeyutils1

libksba8

libldap-2_4-2

libldap-data

liblzma5

libncurses6

libnghttp2-14

libnpth0

libopenssl3

libpcre2-8-0

libpsl5

libreadline7

libsasl2-3

libselinux1

libsqlite3-0

libssh-config

libssh4

libstdc++6

libudev1

libunistring2

libusb-1_0-0

libverto1

libz1

libzio1

libzstd1

openssh-clients

openssh-common

perl-base

pinentry

skelcd-EULA-bci

sles-release

system-user-root

terminfo-base

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.

CVE-2026-56855

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

GO-2026-5932

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.

CVE-2026-78662

kustomize:5.8.1-23.21

Attestation