Package
velero-plugin-for-alicloud
Component
google.golang.org/grpc
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Not yet fixable in this package: CVE-2026-84445 is fixed in google.golang.org/grpc 1.82.2 (https://github.com/advisories/GHSA-2v4p-qf9q-27wj), but velero-plugin 1.0.0, the latest upstream release, is built against grpc 1.26.0 and the older protobuf API, which current grpc releases no longer support. Moving grpc forward in place does not build; it needs upstream to move the plugin onto the newer grpc and protobuf dependencies. The upstream development branch uses grpc 1.73.0, which is also below the fixed version. Waiting for the first upstream release containing the fix.
Status
Impact
Govulncheck found vulnerable symbols in Go binary at usr/bin/velero-plugin-for-alibabacloud.
Status