CVE-2025-9708 - Orleans 3.x KubernetesClient vulnerability
- Dominant language
- C#
- Stars
- 10.9k
- Forks
- 2.1k
- Avg merge
- 15h 1m
- Merged PRs (30d)
- 345
Description
### Summary
The newly reported vulnerability **CVE-2025-9708** in `KubernetesClient`.
### Current Targets vs. Available Versions
`KubernetesClient` **v17.0.14+** includes a fix for this vulnerability. However, that package line only supports **`net8.0`** and **`net9.0`** target frameworks.
Our `3.x` branch targets the following frameworks with these latest `KubernetesClient` versions:
| Target framework | Latest `KubernetesClient` available | Contains the CVE fix? |
|:---:|:---:|:--:|
| `netstandard2.0` | 4.0.26 | ❌ |
| `netcoreapp3.1` | 9.1.3 | ❌ |
| `net6.0` | 15.0.1 | ❌ |
| `net8.0` | 17.0.14+ | ✅ |
| `net9.0` | 17.0.14+ | ✅ |
### Decision Needed
- What to do with unsupported target frameworks?
### References
- CVE: **CVE-2025-9708**
Contributor guide
Assessment
This issue has not been assessed yet.