# Kubescape v4.0.20

> Security · 2026-11-06

A maintenance release focused on correctness, input validation, and protections against denial-of-service conditions. It also enforces restrictions on invalid scan options and tightens handling of scan inputs.

## Action needed
- **[security]** Bound and validated report file reads
  - The `fixhandler` now bounds and validates report file reads to prevent denial-of-service conditions.
- **[security]** Bound HTTP response bodies in `httpGet`
  - The `resourcehandler` now bounds the HTTP response body read by `httpGet` to prevent denial-of-service conditions.
- **[security]** Bound downloaded `CEL` policy response bodies
  - The `vap` component now bounds downloaded `CEL` policy response bodies to prevent denial-of-service conditions.

## Check if affected
- **[breaking]** Rejected Helm and file-path flags on image scans
  - Applies if you run image scans.
  - Image scans now reject Helm and file-path flags.
- **[breaking]** Rejected namespace and resource kind filter flags on workload scans
  - Applies if you run workload scans.
  - Workload scans now reject namespace and resource kind filter flags.

## Other recorded changes
- 13 (defect_corrected 13)

[Full analysis](https://ratatosk.io/en/releases/kubescape/v4.0.20)

[Original release notes](https://github.com/kubescape/kubescape/releases/tag/v4.0.20)