Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
grafana/loki
main @ 77552d2
162
Fixes
2
CVEs
HIGH
Peak severity
40.0%
Coverage
Highlights
Denial of Service: 124 prior fixes. Scrutinize any change in this area.
operator: most-fixed (7 issues). Treat as high-risk during review.
51 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Incomplete validation of tenant-supplied identifiers allowed directory traversal attacks via crafted headers, as tracked in CVE-2021-36156. Sanitizing these boundaries is critical to prevent arbitrary local file reads.
Auth Bypass: Unanchored regular expressions in gateway NGINX configuration allowed attackers to bypass routing restrictions and access privileged backend endpoints. Exact and prefix matching rules are necessary to preserve the integrity of tenant boundaries.
Denial of Service: The query engine frequently suffered from memory leaks and panics due to improper reference-counting and lifecycle management of Apache Arrow column vectors, arrays, and record batches during query evaluation.