dtm-labs/dtmdriver-dapr

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2024-41110 moby: Authz zero length regression
  go.mod
  A package you depend on has a known security hole (CVE-2024-41110). Fix: Update that package to its patched version.
• Serious CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key
  go.mod
  A package you depend on has a known security hole (CVE-2022-1996). Fix: Update that package to its patched version.
• Serious GHSA-r277-6w6q-xmqw kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
  go.mod
  A package you depend on has a known security hole (GHSA-r277-6w6q-xmqw). Fix: Update that package to its patched version.
• Serious CVE-2022-40083 Labstack Echo v4.8.0 was discovered to contain an open redirect vulner ...
  go.mod
  A package you depend on has a known security hole (CVE-2022-40083). Fix: Update that package to its patched version.
• Serious CVE-2025-30215 nats-server: NATS-Server Fails to Authorize Certain Jetstream Admin APIs
  go.mod
  A package you depend on has a known security hole (CVE-2025-30215). Fix: Update that package to its patched version.
• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-35255 azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity
  go.mod
  A package you depend on has a known security hole (CVE-2024-35255). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41602 github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation
  go.mod
  A package you depend on has a known security hole (CVE-2026-41602). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-32285 github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input
  go.mod
  A package you depend on has a known security hole (CVE-2026-32285). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-25621 github.com/containerd/containerd: containerd local privilege escalation
  go.mod
  A package you depend on has a known security hole (CVE-2024-25621). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23471 containerd is an open source container runtime. A bug was found in con ...
  go.mod
  A package you depend on has a known security hole (CVE-2022-23471). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-31030 containerd is an open source container runtime. A bug was found in the ...
  go.mod
  A package you depend on has a known security hole (CVE-2022-31030). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-25153 containerd: OCI image importer memory exhaustion
  go.mod
  A package you depend on has a known security hole (CVE-2023-25153). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-25173 containerd: Supplementary groups are not set up properly
  go.mod
  A package you depend on has a known security hole (CVE-2023-25173). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-40635 containerd: containerd has an integer overflow in User ID handling
  go.mod
  A package you depend on has a known security hole (CVE-2024-40635). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-64329 github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks
  go.mod
  A package you depend on has a known security hole (CVE-2025-64329). Fix: Update that package to its patched version.
• Worth fixing GHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a container
  go.mod
  A package you depend on has a known security hole (GHSA-7ww5-4wqc-m92c). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-24778 imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path
  go.mod
  A package you depend on has a known security hole (CVE-2022-24778). Fix: Update that package to its patched version.
• Worth fixing GHSA-6xv5-86q9-7xr8 SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced
  go.mod
  A package you depend on has a known security hole (GHSA-6xv5-86q9-7xr8). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41491 Dapr: Service Invocation path traversal ACL bypass
  go.mod
  A package you depend on has a known security hole (CVE-2026-41491). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-37918 Dapr API token authentication bypass in HTTP endpoints
  go.mod
  A package you depend on has a known security hole (CVE-2023-37918). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33540 github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL
  go.mod
  A package you depend on has a known security hole (CVE-2026-33540). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-35172 github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion
  go.mod
  A package you depend on has a known security hole (CVE-2026-35172). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41888 github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion
  go.mod
  A package you depend on has a known security hole (CVE-2026-41888). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-15558 docker/cli: Docker CLI for Windows: Privilege escalation via malicious plugin binaries
  go.mod
  A package you depend on has a known security hole (CVE-2025-15558). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Worth fixing GO-2023-1955 Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2023-37918). Fix: Update that package to its patched version.
• Worth fixing GO-2026-5242 Dapr: Service Invocation path traversal ACL bypass in github.com/dapr/dapr
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2026-41491). Fix: Update that package to its patched version.
• Worth fixing GO-2023-2153 Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2024-24786). Fix: Update that package to its patched version.
• Worth fixing GO-2022-0969 Denial of service in net/http and golang.org/x/net/http2
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2022-27664). Fix: Update that package to its patched version.
• Worth fixing GO-2022-1144 Excessive memory growth in net/http and golang.org/x/net/http2
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2022-41717). Fix: Update that package to its patched version.
• Worth fixing GO-2023-1495 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2022-41721). Fix: Update that package to its patched version.
• Worth fixing GO-2023-1571 Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2022-41723). Fix: Update that package to its patched version.
• Worth fixing GO-2023-1988 Improper rendering of text nodes in golang.org/x/net/html
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2023-3978). Fix: Update that package to its patched version.
• Worth fixing GO-2023-2102 HTTP/2 rapid reset can cause excessive work in net/http
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2023-39325). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2687 HTTP/2 CONTINUATION flood in net/http
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2023-45288). Fix: Update that package to its patched version.
• Worth fixing GO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2025-22870). Fix: Update that package to its patched version.
• Worth fixing GO-2025-3595 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2025-22872). Fix: Update that package to its patched version.
• Worth fixing GO-2026-5028 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2026-25680). Fix: Update that package to its patched version.
• Worth fixing GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2023-44487). Fix: Update that package to its patched version.
• Worth fixing GO-2022-1059 Denial of service via crafted Accept-Language header in golang.org/x/text/language
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.sum
  A package you depend on has a known security hole (CVE-2022-32149). Fix: Update that package to its patched version.
• FYI GO-2021-0263 Panic on invalid symbol tables in debug/macho
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2021-41771). Fix: Update that package to its patched version.
• FYI GO-2021-0264 Panic when opening certain archives in archive/zip
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2021-41772). Fix: Update that package to its patched version.
• FYI GO-2021-0317 Uncontrolled memory consumption in math/big
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2022-23772). Fix: Update that package to its patched version.
• FYI GO-2021-0319 Incorrect computation for some invalid field elements in crypto/elliptic
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2022-23806). Fix: Update that package to its patched version.
• FYI GO-2021-0347 Stack exhaustion when compiling deeply nested expressions in regexp
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2022-24921). Fix: Update that package to its patched version.
• FYI GO-2022-0273 Panic due to crafted inputs in archive/zip
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2021-39293). Fix: Update that package to its patched version.
• FYI GO-2022-0288 Unbounded memory growth in net/http and golang.org/x/net/http2
  /workdirs/scan-b4428450-1976-444e-987c-47104a937822/go.mod
  A package you depend on has a known security hole (CVE-2021-44716). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: go:timeout