dotnet / dotnet/orleans

CVE-2025-9708 - Orleans 3.x KubernetesClient vulnerability

Open
#9,687 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
C#
Stars
10.9k
Forks
2.1k
Avg merge
15h 1m
Merged PRs (30d)
345

Description

### Summary
The newly reported vulnerability **CVE-2025-9708** in `KubernetesClient`.

### Current Targets vs. Available Versions
`KubernetesClient` **v17.0.14+** includes a fix for this vulnerability. However, that package line only supports **`net8.0`** and **`net9.0`** target frameworks.

Our `3.x` branch targets the following frameworks with these latest `KubernetesClient` versions:

| Target framework | Latest `KubernetesClient` available | Contains the CVE fix? |
|:---:|:---:|:--:|
| `netstandard2.0` | 4.0.26 | ❌ |
| `netcoreapp3.1` | 9.1.3 | ❌ |
| `net6.0` | 15.0.1 | ❌ |
| `net8.0` | 17.0.14+ | ✅ |
| `net9.0` | 17.0.14+ | ✅ |

### Decision Needed
- What to do with unsupported target frameworks?

### References
- CVE: **CVE-2025-9708**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.