Skip to content
QuenchWorks

VEXeasegress

easegress

1 statement, issued .Each one is a scanner finding that is not exploitable in this image, and why.

ImageOpenVEX JSON

@id https://quench-works.com/vex/easegress/2026-11-01

  1. GHSA-2hw4-c9m4-f2fj

    not affected · vulnerable code not present
    • pkg v0.0.0-20231102061027-a6c730fd81f7

    The advisory is the missing http.MaxBytesReader in the admission webhook handler, knative.dev/pkg/webhook/admission.go:109-117. Easegress reaches knative.dev/pkg only indirectly (go.mod line 382, via knative.dev/serving and knative.dev/client for the FaaS controller) and links API, logging, controller and injection packages of it. Verified with `go list -deps ./cmd/server ./cmd/client` at v2.9.4, v2.10.1 and v2.11.0: 30 knative.dev/pkg packages each, zero under knative.dev/pkg/webhook. The recipe runs the same go list after the build and fails if knative.dev/pkg/webhook is ever linked.