# Snyk test report

March 8th 2026, 12:28:16 am (UTC+00:00)

Scanned the following paths:

- ghcr.io/dexidp/dex:v2.45.0/dexidp/dex (apk)
- ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5//usr/local/bin/gomplate (gomodules)
- ghcr.io/dexidp/dex:v2.45.0/dexidp/dex//usr/local/bin/docker-entrypoint (gomodules)
- ghcr.io/dexidp/dex:v2.45.0/dexidp/dex//usr/local/bin/dex (gomodules)

27 known vulnerabilities
46 vulnerable dependency paths
1189 dependencies

## Out-of-bounds Write

critical severity
Exploit: Not Defined

- Package Manager: alpine:3.23
- Vulnerable module: zlib/zlib
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 and zlib/zlib@1.3.1-r2

### Detailed paths

- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 › zlib/zlib@1.3.1-r2
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 › apk-tools/apk-tools@3.0.3-r1 › zlib/zlib@1.3.1-r2
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 › apk-tools/apk-tools@3.0.3-r1 › apk-tools/libapk@3.0.3-r1 › zlib/zlib@1.3.1-r2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`. See `How to fix?` for `Alpine:3.23` relevant fixed versions and status.

zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.

## Remediation

Upgrade `Alpine:3.23` `zlib` to version 1.3.2-r0 or higher.

## References

- https://github.com/madler/zlib
- https://seclists.org/fulldisclosure/2026/Jan/3
- https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname
- https://zlib.net/
- https://github.com/madler/zlib/issues/1142

More about this vulnerability

## Untrusted Search Path

high severity
Exploit: Not Defined

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Vulnerable module: go.opentelemetry.io/otel/sdk/resource
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and go.opentelemetry.io/otel/sdk/resource@v1.39.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › go.opentelemetry.io/otel/sdk/resource@v1.39.0

## Overview

Affected versions of this package are vulnerable to Untrusted Search Path in resource detection code which executes `ioreg`, when the `PATH` environment variable is modified to include a malicious executable. An attacker can execute arbitrary code within the context of the application by placing a malicious binary earlier in the search path.

Note: This vulnerability is only exploitable on MacOS/Darwin systems.

## Remediation

Upgrade `go.opentelemetry.io/otel/sdk/resource` to version 1.40.0 or higher.

## References

- GitHub Commit

More about this vulnerability

## Improper Validation of Specified Quantity in Input

medium severity
Exploit: Not Defined

- Package Manager: alpine:3.23
- Vulnerable module: zlib/zlib
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 and zlib/zlib@1.3.1-r2

### Detailed paths

- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 › zlib/zlib@1.3.1-r2
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 › apk-tools/apk-tools@3.0.3-r1 › zlib/zlib@1.3.1-r2
- Introduced through: docker-image|ghcr.io/dexidp/dex@v2.45.0 › apk-tools/apk-tools@3.0.3-r1 › apk-tools/libapk@3.0.3-r1 › zlib/zlib@1.3.1-r2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`. See `How to fix?` for `Alpine:3.23` relevant fixed versions and status.

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.

## Remediation

Upgrade `Alpine:3.23` `zlib` to version 1.3.2-r0 or higher.

## References

- https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/
- https://github.com/madler/zlib/issues/904
- https://github.com/madler/zlib/releases/tag/v1.3.2
- https://ostif.org/zlib-audit-complete/
- https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf

More about this vulnerability

## Uncaught Exception

medium severity
Exploit: Not Defined

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/dexidp/dex › /usr/local/bin/dex
- Package Manager: golang
- Vulnerable module: golang.org/x/net/http2
- Introduced through: github.com/dexidp/dex@* and golang.org/x/net/http2@v0.50.0

### Detailed paths

- Introduced through: github.com/dexidp/dex@* › golang.org/x/net/http2@v0.50.0

## Overview

golang.org/x/net/http2 is a work-in-progress HTTP/2 implementation for Go.

Affected versions of this package are vulnerable to Uncaught Exception due to missing nil check. An attacker can cause the server to panic and potentially disrupt service by sending specially crafted HTTP/2 frames with values between `0x0a` and `0x0f`.

## Remediation

Upgrade `golang.org/x/net/http2` to version 0.51.0 or higher.

## References

- Go Advisory
- Go Commit
- Go Issue

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/dexidp/dex › /usr/local/bin/dex
- Package Manager: golang
- Module: github.com/openbao/openbao/api/v2
- Introduced through: github.com/dexidp/dex@* and github.com/openbao/openbao/api/v2@v2.5.1

### Detailed paths

- Introduced through: github.com/dexidp/dex@* › github.com/openbao/openbao/api/v2@v2.5.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/vault/api/auth/userpass
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/vault/api/auth/userpass@v0.11.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/vault/api/auth/userpass@v0.11.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/vault/api/auth/aws
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/vault/api/auth/aws@v0.11.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/vault/api/auth/aws@v0.11.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/vault/api
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/vault/api@v1.22.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/vault/api@v1.22.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/serf/coordinate
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/serf/coordinate@v0.10.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/serf/coordinate@v0.10.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/dexidp/dex › /usr/local/bin/dex
- Package Manager: golang
- Module: github.com/hashicorp/hcl/v2
- Introduced through: github.com/dexidp/dex@* and github.com/hashicorp/hcl/v2@v2.18.1

### Detailed paths

- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2@v2.18.1
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/ext/customdecode@v2.18.1
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/ext/tryfunc@v2.18.1
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/gohcl@v2.18.1
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/hclparse@v2.18.1
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/hclsyntax@v2.18.1
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/hclwrite@v2.18.1
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/v2/json@v2.18.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/hcl
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/hcl@v1.0.1-vault-7

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/hcl@v1.0.1-vault-7
- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/hcl/hcl/token@v1.0.1-vault-7
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl@v1.0.1-vault-7
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/hcl/hcl/token@v1.0.1-vault-7

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/golang-lru/simplelru
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/golang-lru/simplelru@v1.0.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/golang-lru/simplelru@v1.0.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-uuid
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-uuid@v1.0.3

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-uuid@v1.0.3

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-sockaddr
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-sockaddr@v1.0.7

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-sockaddr@v1.0.7
- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-sockaddr/template@v1.0.7
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/go-sockaddr@v1.0.7

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-secure-stdlib/strutil
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-secure-stdlib/parseutil
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-secure-stdlib/awsutil
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-secure-stdlib/awsutil@v0.3.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-secure-stdlib/awsutil@v0.3.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-rootcerts
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-rootcerts@v1.0.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-rootcerts@v1.0.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-retryablehttp
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-retryablehttp@v0.7.8

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-retryablehttp@v0.7.8
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/go-retryablehttp@v0.7.8

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-multierror
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-multierror@v1.1.1

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-multierror@v1.1.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-immutable-radix
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-immutable-radix@v1.3.1

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-immutable-radix@v1.3.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/go-cleanhttp
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/go-cleanhttp@v0.5.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/go-cleanhttp@v0.5.2
- Introduced through: github.com/dexidp/dex@* › github.com/hashicorp/go-cleanhttp@v0.5.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/errwrap
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/errwrap@v1.1.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/errwrap@v1.1.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/hashicorp/consul/api
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/hashicorp/consul/api@v1.33.2

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/hashicorp/consul/api@v1.33.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Module: github.com/gosimple/slug
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/gosimple/slug@v1.15.0

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/gosimple/slug@v1.15.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/dexidp/dex › /usr/local/bin/dex
- Package Manager: golang
- Module: github.com/go-sql-driver/mysql
- Introduced through: github.com/dexidp/dex@* and github.com/go-sql-driver/mysql@v1.9.3

### Detailed paths

- Introduced through: github.com/dexidp/dex@* › github.com/go-sql-driver/mysql@v1.9.3

MPL-2.0 license

More about this vulnerability

## Improper Validation of Integrity Check Value

medium severity
Exploit: Not Defined

- Manifest file: ghcr.io/dexidp/dex:v2.45.0/hairyhenderson/gomplate/v5 › /usr/local/bin/gomplate
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/storage/filesystem
- Introduced through: github.com/hairyhenderson/gomplate/v5@* and github.com/go-git/go-git/v5/storage/filesystem@v5.16.4

### Detailed paths

- Introduced through: github.com/hairyhenderson/gomplate/v5@* › github.com/go-git/go-git/v5/storage/filesystem@v5.16.4

## Overview

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value for `.idx` and `.pack` files. An attacker can cause the application to consume corrupted files, leading to unexpected errors, due to checksums not being checked in the `loadIdxFile()` function.

## Workaround

This vulnerability can be mitigated by running 'git fsck' from the git CLI to check for data corruption on a given repository.

## Remediation

Upgrade `github.com/go-git/go-git/v5/storage/filesystem` to version 5.16.5 or higher.

## References

- GitHub Commit
- GitHub Release

More about this vulnerability