-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/fluxcd/kustomize-controller | go | >= 0.16.0, < 0.24.0 | 0.24.0 |
| github.com/fluxcd/flux2 | go | >= 0.19.0, < 0.29.0 | 0.29.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper cycle detection in Kustomization file processing. The reconciliation loop (KustomizationReconciler.reconcile) and resource loader (loader.Load) are core components that process user-provided kustomization.yaml files. The lack of cycle checks in these functions allowed recursive references to cause endless loops. The CWE-674 (Uncontrolled Recursion) alignment and the patched 'blocking references' behavior described in advisories strongly implicate these functions. The high confidence comes from the architectural role of these functions and the explicit mention of path/dependency handling fixes in the patch notes.
GoGoOngoing coverage of React2Shell