the Dapr Runtime, Kit and Components-Contrib sub projects. 3 issues were found. ● 1 index out of range ● 2 panics in Go standard library Table of Contents CNCF security and fuzzing audits 2 Executive and a reproducer testcase. # Title Mitigation 1 Index out of range in ra� log reading Fixed 2 Malicious raw key triggers out of range panic in Go standard library Fixed 3 Key with empty seed will trigger trigger panic in Go standard library Fixed Index out of range in raft log reading OSS-Fuzz bug tracker: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58799 Mitigation: Fixed in https://github

stitch together individual container primitives Flexible application modeling supports a wide range of application architectures Small and simple applications are easy, large and complex applications

to stitch together individual container primitives Flexible application modeling supports a wide range of application architectures Small and simple applications are easy, large and complex applications

that Dapr was clearly implemented with security in mind thus far. Nevertheless, given the reach and range of findings, especially their respective severity levels, a lot of room for improvement is visible

the application does not properly sanitize user input, the Dapr user exposes themselves to a wide range of vulnerabilities. An example from our manual code review are SQL Injections: All components that