AIKIDO-2026-10387
github.com/controlplaneio-fluxcd/flux-operator is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
github.com/controlplaneio-fluxcd/flux-operatorTL;DR
The web UI does not limit the size of request bodies on POST, PUT, or PATCH. A remote attacker can send an oversized body to these endpoints, causing the server to buffer unbounded data and leading to high memory use or denial of service. The fix adds a middleware that wraps the request body with http.MaxBytesReader (1MB limit) for those methods.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/controlplaneio-fluxcd/flux-operator is vulnerable to Denial of Service (DoS) in versions 0.37.0 - 0.43.0.
How to fix this
Upgrade the github.com/controlplaneio-fluxcd/flux-operator library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant