MEDIUM5.3Go
GHSA-8fmj-33gw-g7pw· CVE-2024-35238, GO-2024-2885Denial of service of Minder Server from maliciously crafted GitHub attestations
Modified: 9/10/2026
package
Go/github.com/stacklok/minder
pkg:go/github.com/stacklok/minder
HIGH7.5Go
GHSA-9c5w-9q3f-3hv7· CVE-2024-34084, GO-2024-2821Minder's GitHub Webhook Handler vulnerable to DoS from un-validated requests
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-crgc-2583-rw27· CVE-2024-35194, GO-2024-2871Stacklok Minder vulnerable to denial of service from maliciously crafted templates
Modified: 9/10/2026
MEDIUM5.3Go
GHSA-fjw8-3gp8-4cvx· CVE-2024-35185, GO-2024-2864Denial of service of Minder Server with attacker-controlled REST endpoint
Modified: 9/10/2026
MEDIUM4.3Go
GHSA-ggp5-28x4-xcj9· CVE-2024-31455, GO-2024-2701Minder GetRepositoryByName data leak
Modified: 9/10/2026
MEDIUM5.7Go
GHSA-hpcg-xjq5-g666· CVE-2024-37904, GO-2024-2934Minder affected by denial of service from maliciously configured Git repository
Modified: 9/10/2026
MEDIUM4.6Go
GHSA-q6h8-4j2v-pjg4· CVE-2024-27093, GO-2024-2582Minder trusts client-provided mapping from repo name to upstream ID
Modified: 9/10/2026
HIGH7.1Go
GHSA-v627-69v2-xx37· CVE-2024-27916, GO-2024-2608`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user
Modified: 2/3/2026
—Go
GO-2024-2582· CVE-2024-27093, GHSA-q6h8-4j2v-pjg4Minder trusts client-provided mapping from repo name to upstream ID in github.com/stacklok/minder
Modified: 7/9/2024
—Go
GO-2024-2608· CVE-2024-27916, GHSA-v627-69v2-xx37Minder access control bypass in github.com/stacklok/minder
Modified: 5/20/2024
—Go
GO-2024-2701· CVE-2024-31455, GHSA-ggp5-28x4-xcj9Minder GetRepositoryByName data leak in github.com/stacklok/minder
Modified: 3/3/2026
—Go
GO-2024-2821· CVE-2024-34084, GHSA-9c5w-9q3f-3hv7Denial of Service from untrusted requests in github.com/stacklok/minder
Modified: 5/20/2024
—Go
GO-2024-2864· CVE-2024-35185, GHSA-fjw8-3gp8-4cvxDenial of service of Minder Server with attacker-controlled REST endpoint in github.com/stacklok/minder
Modified: 3/3/2026
—Go
GO-2024-2871· CVE-2024-35194, GHSA-crgc-2583-rw27Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder
Modified: 3/3/2026
—Go
GO-2024-2885· CVE-2024-35238, GHSA-8fmj-33gw-g7pwDenial of service of Minder Server from maliciously crafted GitHub attestations in github.com/stacklok/minder
Modified: 3/3/2026
—Go
GO-2024-2934· CVE-2024-37904, GHSA-hpcg-xjq5-g666Minder affected by denial of service from maliciously configured Git repository in github.com/stacklok/minder
Modified: 3/3/2026