CVE-2026-61795: Capsule HostnameRegexHandler.OnUpdate Validates Stale (old) Tenant Vulnerability
MODERATE
Advisory Identifier:
GHSA-f94q-w3w8-cj67
Advisory Summary
CVE-2026-61795 is a MODERATE (CVSS 6.8) hostnameregexhandler.onupdate validates stale (old) tenant vulnerability (CWE-697: Incorrect Comparison) affecting Capsule libraries in the Go ecosystem. The issue involves hostnameregexhandler.onupdate validates stale (old) tenant regex, allowing invalid allowedhostnames regex to bypass webhook validation. Remediation is available by upgrading affected packages to version 0.13.7.
CVE-2026-61795 at a Glance
CVE Identifier
CVE-2026-61795
GHSA Identifier
GHSA-f94q-w3w8-cj67
Severity
MODERATE
CVSS v3.1 Base Score
6.8
CWE Classification
CWE-697: Incorrect Comparison
Affected Product
Capsule
Package Ecosystem
Go
Published Date
Last Updated
Security Impact
CVSS: 6.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
High (PR:H)
User Interaction
None (UI:N)
Scope
Changed (S:C)
Confidentiality
None (C:N)
Integrity
None (I:N)
Availability
High (A:H)
How to Fix CVE-2026-61795
To remediate this vulnerability, upgrade all affected Capsule dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/projectcapsule/capsule
fixed: 0.13.7
Upgrade github.com/projectcapsule/capsule to 0.13.7
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/projectcapsule/capsuleHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-61795, inspect your project dependencies for Capsule:
inspect dependencies for github.com/projectcapsule/capsuleAnalyze the terminal output to locate any version of Capsule in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.13.7), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-697: Incorrect Comparison, where the product compares two entities in a security-relevant context, but the comparison is incorrect. In Capsule, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
A parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHandler.OnUpdate` webhook to validate the **old** Tenant object's `AllowedHostnames.Regex` instead of the **new** one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.
### Details
The `TypedHandler[T]` interface defines `OnUpdate` as:
```go
// handlers.go
OnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func
// ^^^ NEW ^^^ OLD
```
The dispatcher in `handler.go:93` calls:
```go
hndl.OnUpdate(c, reader, tnt, old, decoder, recorder)
// ^^^ NEW ^^^ OLD
```
However, `hostnameRegexHandler.OnUpdate` in `hostname_regex.go` declares its parameters in **reversed order**:
```go
// hostname_regex.go (BUGGY)
func (h *hostnameRegexHandler) OnUpdate(
_ client.Client,
_ client.Reader,
old *capsulev1beta2.Tenant, // ← receives NEW tenant (mislabeled as old)
tnt *capsulev1beta2.Tenant, // ← receives OLD tenant (mislabeled as tnt)
...
) handlers.Func {
return func(...) *admission.Response {
if err := h.validate(tnt, req); err != nil { // ← validates OLD, not NEW
return err
}
return nil
}
}
```
All 11 other handlers in the same package declare `(tnt, old)` correctly. `hostname_regex.go` is the only one with the swap.
As a result, when a Cluster Admin updates `Tenant.Spec.IngressOptions.AllowedHostnames.Regex` to a malformed value, the webhook compiles the **previous valid regex** and returns `Allow`. The malformed regex is then written to etcd.
Subsequently, every Ingress `CREATE` or `UPDATE` in that tenant triggers `validate_hostnames.go:160`:
```go
matched, _ = regexp.MatchString(allowedRegex, currentHostname)
```
`regexp.MatchString` with an invalid pattern returns `(false, error)`. The error is silently ignored, `matched` is `false`, and **every hostname is rejected** — blocking all Ingress operations in the tenant until the Tenant object is manually corrected by an admin.
### PoC
```
//go:build ignore
// Standalone reproducer for hostname_regex.go argument swap bug in Capsule
// No external deps - shows the bug logic using only stdlib
package main
import (
"fmt"
"regexp"
)
// Simulating the Tenant spec structure
type AllowedHostnames struct {
Regex string
}
type IngressOptions struct {
AllowedHostnames *AllowedHostnames
}
type TenantSpec struct {
IngressOptions IngressOptions
}
type Tenant struct {
Name string
Spec TenantSpec
}
// =========================================================
// BUGGY implementation (hostname_regex.go as-is)
// OnUpdate(_, _, old *Tenant, tnt *Tenant) → validates OLD
// =========================================================
func hostnameValidate(tnt *Tenant) error {
if tnt.Spec.IngressOptions.AllowedHostnames == nil {
return nil
}
if len(tnt.Spec.IngressOptions.AllowedHostnames.Regex) == 0 {
return nil
}
_, err := regexp.Compile(tnt.Spec.IngressOptions.AllowedHostnames.Regex)
if err != nil {
return fmt.Errorf("Deny: unable to compile allowedHostnames allowedRegex")
}
return nil
}
// Dispatcher calls: OnUpdate(c, reader, newTenant, oldTenant, ...)
// Interface says: OnUpdate(c, reader, obj[NEW], old[OLD], ...)
//
// BUGGY handler receives: (old, tnt) meaning:
// 3rd param (labeled "old") = actually NEW
// 4th param (labeled "tnt") = actually OLD
// Then calls h.validate(tnt) = validates the OLD tenant
func buggyOnUpdate(newTenant, oldTenant *Tenant) error {
// BUG: parameters are SWAPPED vs the interface contract
old := newTenant // dispatcher's "new" arrives as "old" in this function
tnt := oldTenant // dispatcher's "old" arrives as "tnt" in this function
_ = old // unused in the real code too
return hostnameValidate(tnt) // validates OLD, not NEW
}
// CORRECT implementation (what it should be)
func correctOnUpdate(newTenant, oldTenant *Tenant) error {
_ = oldTenant
return hostnameValidate(newTenant) // validates NEW
}
// Simulate ingress hostname validation AFTER bad regex is stored
func validateIngressHostname(tenant *Tenant, hostname string) bool {
if tenant.Spec.IngressOptions.AllowedHostnames == nil {
return true
}
allowedRegex := tenant.Spec.IngressOptions.AllowedHostnames.Regex
if len(allowedRegex) == 0 {
return true
}
// This is validate_hostnames.go:160 - error is IGNORED
matched, _ := regexp.MatchString(allowedRegex, hostname)
return matched
}
func main() {
fmt.Println("=== Capsule Bug Reproducer: hostname_regex.go argument swap ===")
fmt.Println()
oldTenant := &Tenant{
Name: "demo-tenant",
Spec: TenantSpec{
IngressOptions: IngressOptions{
AllowedHostnames: &AllowedHostnames{
Regex: `^[\w.-]+\.example\.com$`, // valid regex
},
},
},
}
// Attacker (cluster admin) sets an INVALID regex in the new spec
newTenant := &Tenant{
Name: "demo-tenant",
Spec: TenantSpec{
IngressOptions: IngressOptions{
AllowedHostnames: &AllowedHostnames{
Regex: `[invalid-regex(`, // INVALID regex
},
},
},
}
fmt.Printf("Old tenant regex: %q (valid)\n", oldTenant.Spec.IngressOptions.AllowedHostnames.Regex)
fmt.Printf("New tenant regex: %q (INVALID)\n", newTenant.Spec.IngressOptions.AllowedHostnames.Regex)
fmt.Println()
// Step 1: Webhook runs OnUpdate
fmt.Println("--- Step 1: Webhook OnUpdate ---")
err := buggyOnUpdate(newTenant, oldTenant)
if err != nil {
fmt.Printf("[BUGGY] Webhook DENIES update: %v\n", err)
} else {
fmt.Println("[BUGGY] Webhook ALLOWS update (validates OLD regex) ← WRONG")
}
err = correctOnUpdate(newTenant, oldTenant)
if err != nil {
fmt.Printf("[CORRECT] Webhook DENIES update: %v ← EXPECTED\n", err)
} else {
fmt.Println("[CORRECT] Webhook ALLOWS update")
}
// Step 2: Invalid regex now stored in etcd - simulate ingress validation
fmt.Println()
fmt.Println("--- Step 2: Ingress creation after bad regex stored ---")
storedTenant := newTenant // bad regex is now in etcd
hostnames := []string{
"app.example.com",
"api.example.com",
"evil.attacker.com",
}
for _, h := range hostnames {
allowed := validateIngressHostname(storedTenant, h)
fmt.Printf(" Ingress hostname %q → allowed=%v", h, allowed)
if !allowed {
fmt.Print(" ← BLOCKED (DoS: invalid regex causes all hostnames to fail)")
}
fmt.Println()
}
fmt.Println()
fmt.Println("=== Result ===")
fmt.Println("Invalid regex bypasses webhook validation and gets stored.")
fmt.Println("All subsequent Ingress create/update in this tenant are BLOCKED.")
fmt.Println("CWE-697: Incorrect Comparison — wrong Tenant object is validated.")
}
```
```go
// Simulates the buggy webhook behaviour
oldTenant := &Tenant{AllowedRegex: `^[\w-]+\.example\.com$`} // valid
newTenant := &Tenant{AllowedRegex: `[invalid-regex(`} // malformed
// Buggy OnUpdate: validates oldTenant (valid) → ALLOW
// Correct OnUpdate: validates newTenant (invalid) → DENY
// After malformed regex is stored, all ingress hostnames are rejected:
matched, _ := regexp.MatchString(`[invalid-regex(`, "app.example.com")
// matched = false, error ignored → Ingress blocked
```
### Fix
Swap the parameter names in `hostname_regex.go` to match the interface contract:
```go
// BEFORE (buggy)
func (h *hostnameRegexHandler) OnUpdate(
_ client.Client,
_ client.Reader,
old *capsulev1beta2.Tenant,
tnt *capsulev1beta2.Tenant,
...
// AFTER (fixed)
func (h *hostnameRegexHandler) OnUpdate(
_ client.Client,
_ client.Reader,
tnt *capsulev1beta2.Tenant,
old *capsulev1beta2.Tenant,
...
```
### Impact
A Cluster Admin (or a compromised admin account) can — intentionally or via a typo — set a malformed `AllowedHostnames.Regex` on any Tenant. The webhook silently accepts the update. All users in the affected tenant are subsequently unable to create or update any Ingress resource until an admin manually corrects the Tenant spec. This constitutes a targeted Denial of Service against the tenant's ingress layer.
CVE-2026-61795 Affected Capsule Versions
1 component(s)
Fixed Versions:
0.13.7
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/projectcapsule/capsule
|
Go |
≥ 0.13.0
< 0.13.7
|
0.13.7
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67
Capsule Source Repository
REPOSITORY
https://github.com/projectcapsule/capsule/pull/1983
Security Fix Commit
FIX COMMIT
https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e
Capsule Source Repository
REPOSITORY
https://github.com/projectcapsule/capsule
Capsule Release
RELEASE
https://github.com/projectcapsule/capsule/releases/tag/v0.13.7
Frequently Asked Questions
What is CVE-2026-61795?
CVE-2026-61795 is a security vulnerability in Capsule involving hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation under CWE-697: Incorrect Comparison.
Which Capsule versions are affected?
Affected versions include releases prior to 0.13.7 across affected packages: github.com/projectcapsule/capsule.
What version fixes CVE-2026-61795?
Upgrading to 0.13.7 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/projectcapsule/capsule affected?
Yes, github.com/projectcapsule/capsule is affected in releases prior to 0.13.7. Upgrade your dependency to 0.13.7 or later.
What is the CVSS score of CVE-2026-61795?
CVE-2026-61795 has a CVSS v3.1 base score of 6.8 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H.
What CWE is associated with CVE-2026-61795?
CVE-2026-61795 is classified under CWE-697: Incorrect Comparison (The product compares two entities in a security-relevant context, but the comparison is incorrect.).
How can I check Go dependencies for CVE-2026-61795?
Run the dependency tree command: 'inspect dependencies for github.com/projectcapsule/capsule'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-f94q-w3w8-cj67",
"modified" : "2026-09-18T17:14:43Z",
"published" : "2026-09-18T17:14:43Z",
"aliases" : [ "CVE-2026-61795" ],
"summary" : "Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation",
"details" : "### Summary\n\nA parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHandler.OnUpdate` webhook to validate the **old** Tenant object's `AllowedHostnames.Regex` instead of the **new** one being submitted. This allows an invalid (malformed) regex to bypass admission validation and be persisted to etcd, causing a Denial of Service for all Ingress operations within the affected tenant.\n\n### Details\n\nThe `TypedHandler[T]` interface defines `OnUpdate` as:\n\n```go\n// handlers.go\nOnUpdate(c client.Client, reader client.Reader, obj T, old T, decoder admission.Decoder, recorder events.EventRecorder) Func\n// ^^^ NEW ^^^ OLD\n```\n\nThe dispatcher in `handler.go:93` calls:\n```go\nhndl.OnUpdate(c, reader, tnt, old, decoder, recorder)\n// ^^^ NEW ^^^ OLD\n```\n\nHowever, `hostnameRegexHandler.OnUpdate` in `hostname_regex.go` declares its parameters in **reversed order**:\n\n```go\n// hostname_regex.go (BUGGY)\nfunc (h *hostnameRegexHandler) OnUpdate(\n _ client.Client,\n _ client.Reader,\n old *capsulev1beta2.Tenant, // ← receives NEW tenant (mislabeled as old)\n tnt *capsulev1beta2.Tenant, // ← receives OLD tenant (mislabeled as tnt)\n ...\n) handlers.Func {\n return func(...) *admission.Response {\n if err := h.validate(tnt, req); err != nil { // ← validates OLD, not NEW\n return err\n }\n return nil\n }\n}\n```\n\nAll 11 other handlers in the same package declare `(tnt, old)` correctly. `hostname_regex.go` is the only one with the swap.\n\nAs a result, when a Cluster Admin updates `Tenant.Spec.IngressOptions.AllowedHostnames.Regex` to a malformed value, the webhook compiles the **previous valid regex** and returns `Allow`. The malformed regex is then written to etcd.\n\nSubsequently, every Ingress `CREATE` or `UPDATE` in that tenant triggers `validate_hostnames.go:160`:\n\n```go\nmatched, _ = regexp.MatchString(allowedRegex, currentHostname)\n```\n\n`regexp.MatchString` with an invalid pattern returns `(false, error)`. The error is silently ignored, `matched` is `false`, and **every hostname is rejected** — blocking all Ingress operations in the tenant until the Tenant object is manually corrected by an admin.\n\n### PoC\n\n```\n//go:build ignore\n// Standalone reproducer for hostname_regex.go argument swap bug in Capsule\n// No external deps - shows the bug logic using only stdlib\n\npackage main\n\nimport (\n\t\"fmt\"\n\t\"regexp\"\n)\n\n// Simulating the Tenant spec structure\ntype AllowedHostnames struct {\n\tRegex string\n}\n\ntype IngressOptions struct {\n\tAllowedHostnames *AllowedHostnames\n}\n\ntype TenantSpec struct {\n\tIngressOptions IngressOptions\n}\n\ntype Tenant struct {\n\tName string\n\tSpec TenantSpec\n}\n\n// =========================================================\n// BUGGY implementation (hostname_regex.go as-is)\n// OnUpdate(_, _, old *Tenant, tnt *Tenant) → validates OLD\n// =========================================================\nfunc hostnameValidate(tnt *Tenant) error {\n\tif tnt.Spec.IngressOptions.AllowedHostnames == nil {\n\t\treturn nil\n\t}\n\tif len(tnt.Spec.IngressOptions.AllowedHostnames.Regex) == 0 {\n\t\treturn nil\n\t}\n\t_, err := regexp.Compile(tnt.Spec.IngressOptions.AllowedHostnames.Regex)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"Deny: unable to compile allowedHostnames allowedRegex\")\n\t}\n\treturn nil\n}\n\n// Dispatcher calls: OnUpdate(c, reader, newTenant, oldTenant, ...)\n// Interface says: OnUpdate(c, reader, obj[NEW], old[OLD], ...)\n//\n// BUGGY handler receives: (old, tnt) meaning:\n// 3rd param (labeled \"old\") = actually NEW\n// 4th param (labeled \"tnt\") = actually OLD\n// Then calls h.validate(tnt) = validates the OLD tenant\nfunc buggyOnUpdate(newTenant, oldTenant *Tenant) error {\n\t// BUG: parameters are SWAPPED vs the interface contract\n\told := newTenant // dispatcher's \"new\" arrives as \"old\" in this function\n\ttnt := oldTenant // dispatcher's \"old\" arrives as \"tnt\" in this function\n\t_ = old // unused in the real code too\n\treturn hostnameValidate(tnt) // validates OLD, not NEW\n}\n\n// CORRECT implementation (what it should be)\nfunc correctOnUpdate(newTenant, oldTenant *Tenant) error {\n\t_ = oldTenant\n\treturn hostnameValidate(newTenant) // validates NEW\n}\n\n// Simulate ingress hostname validation AFTER bad regex is stored\nfunc validateIngressHostname(tenant *Tenant, hostname string) bool {\n\tif tenant.Spec.IngressOptions.AllowedHostnames == nil {\n\t\treturn true\n\t}\n\tallowedRegex := tenant.Spec.IngressOptions.AllowedHostnames.Regex\n\tif len(allowedRegex) == 0 {\n\t\treturn true\n\t}\n\t// This is validate_hostnames.go:160 - error is IGNORED\n\tmatched, _ := regexp.MatchString(allowedRegex, hostname)\n\treturn matched\n}\n\nfunc main() {\n\tfmt.Println(\"=== Capsule Bug Reproducer: hostname_regex.go argument swap ===\")\n\tfmt.Println()\n\n\toldTenant := &Tenant{\n\t\tName: \"demo-tenant\",\n\t\tSpec: TenantSpec{\n\t\t\tIngressOptions: IngressOptions{\n\t\t\t\tAllowedHostnames: &AllowedHostnames{\n\t\t\t\t\tRegex: `^[\\w.-]+\\.example\\.com$`, // valid regex\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n\n\t// Attacker (cluster admin) sets an INVALID regex in the new spec\n\tnewTenant := &Tenant{\n\t\tName: \"demo-tenant\",\n\t\tSpec: TenantSpec{\n\t\t\tIngressOptions: IngressOptions{\n\t\t\t\tAllowedHostnames: &AllowedHostnames{\n\t\t\t\t\tRegex: `[invalid-regex(`, // INVALID regex\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n\n\tfmt.Printf(\"Old tenant regex: %q (valid)\\n\", oldTenant.Spec.IngressOptions.AllowedHostnames.Regex)\n\tfmt.Printf(\"New tenant regex: %q (INVALID)\\n\", newTenant.Spec.IngressOptions.AllowedHostnames.Regex)\n\tfmt.Println()\n\n\t// Step 1: Webhook runs OnUpdate\n\tfmt.Println(\"--- Step 1: Webhook OnUpdate ---\")\n\n\terr := buggyOnUpdate(newTenant, oldTenant)\n\tif err != nil {\n\t\tfmt.Printf(\"[BUGGY] Webhook DENIES update: %v\\n\", err)\n\t} else {\n\t\tfmt.Println(\"[BUGGY] Webhook ALLOWS update (validates OLD regex) ← WRONG\")\n\t}\n\n\terr = correctOnUpdate(newTenant, oldTenant)\n\tif err != nil {\n\t\tfmt.Printf(\"[CORRECT] Webhook DENIES update: %v ← EXPECTED\\n\", err)\n\t} else {\n\t\tfmt.Println(\"[CORRECT] Webhook ALLOWS update\")\n\t}\n\n\t// Step 2: Invalid regex now stored in etcd - simulate ingress validation\n\tfmt.Println()\n\tfmt.Println(\"--- Step 2: Ingress creation after bad regex stored ---\")\n\tstoredTenant := newTenant // bad regex is now in etcd\n\n\thostnames := []string{\n\t\t\"app.example.com\",\n\t\t\"api.example.com\",\n\t\t\"evil.attacker.com\",\n\t}\n\n\tfor _, h := range hostnames {\n\t\tallowed := validateIngressHostname(storedTenant, h)\n\t\tfmt.Printf(\" Ingress hostname %q → allowed=%v\", h, allowed)\n\t\tif !allowed {\n\t\t\tfmt.Print(\" ← BLOCKED (DoS: invalid regex causes all hostnames to fail)\")\n\t\t}\n\t\tfmt.Println()\n\t}\n\n\tfmt.Println()\n\tfmt.Println(\"=== Result ===\")\n\tfmt.Println(\"Invalid regex bypasses webhook validation and gets stored.\")\n\tfmt.Println(\"All subsequent Ingress create/update in this tenant are BLOCKED.\")\n\tfmt.Println(\"CWE-697: Incorrect Comparison — wrong Tenant object is validated.\")\n}\n```\n\n\n\n\n```go\n// Simulates the buggy webhook behaviour\noldTenant := &Tenant{AllowedRegex: `^[\\w-]+\\.example\\.com$`} // valid\nnewTenant := &Tenant{AllowedRegex: `[invalid-regex(`} // malformed\n\n// Buggy OnUpdate: validates oldTenant (valid) → ALLOW\n// Correct OnUpdate: validates newTenant (invalid) → DENY\n\n// After malformed regex is stored, all ingress hostnames are rejected:\nmatched, _ := regexp.MatchString(`[invalid-regex(`, \"app.example.com\")\n// matched = false, error ignored → Ingress blocked\n```\n\n### Fix\n\nSwap the parameter names in `hostname_regex.go` to match the interface contract:\n\n```go\n// BEFORE (buggy)\nfunc (h *hostnameRegexHandler) OnUpdate(\n _ client.Client,\n _ client.Reader,\n old *capsulev1beta2.Tenant,\n tnt *capsulev1beta2.Tenant,\n ...\n\n// AFTER (fixed)\nfunc (h *hostnameRegexHandler) OnUpdate(\n _ client.Client,\n _ client.Reader,\n tnt *capsulev1beta2.Tenant,\n old *capsulev1beta2.Tenant,\n ...\n```\n\n### Impact\n\nA Cluster Admin (or a compromised admin account) can — intentionally or via a typo — set a malformed `AllowedHostnames.Regex` on any Tenant. The webhook silently accepts the update. All users in the affected tenant are subsequently unable to create or update any Ingress resource until an admin manually corrects the Tenant spec. This constitutes a targeted Denial of Service against the tenant's ingress layer.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/projectcapsule/capsule"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.13.0"
}, {
"fixed" : "0.13.7"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/projectcapsule/capsule/security/advisories/GHSA-f94q-w3w8-cj67"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcapsule/capsule/pull/1983"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcapsule/capsule/commit/8d89d6865df6f41c7faa22fc9e807a57b01bfd0e"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/projectcapsule/capsule"
}, {
"type" : "WEB",
"url" : "https://github.com/projectcapsule/capsule/releases/tag/v0.13.7"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-697" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-09-18T17:14:43Z",
"nvd_published_at" : null
}
}