CVE-2026-78669 affecting package azcopy for versions less than 10.25.1-10

CVE-2026-78669 affecting package azcopy for versions less than 10.25.1-10. A patched version of the package is available...

CVE-2026-78660 affecting package azcopy for versions less than 10.25.1-10

CVE-2026-78660 affecting package azcopy for versions less than 10.25.1-10. A patched version of the package is available...

OPENSUSE-SU-2026:12140-1 azure-storage-azcopy-10.32.8-2.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.8-2.1 package on the GA media of openSUSE Tumbleweed...

AZL-107153 CVE-2026-97032 affecting package azcopy 10.25.1-9

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107150 CVE-2026-78669 affecting package azcopy 10.25.1-9

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107162 CVE-2026-78663 affecting package azcopy 10.25.1-9

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107159 CVE-2026-78659 affecting package azcopy 10.25.1-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107156 CVE-2026-78660 affecting package azcopy 10.25.1-9

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-84445 affecting package azcopy for versions less than 10.25.1-9

CVE-2026-84445 affecting package azcopy for versions less than 10.25.1-9. An upgraded version of the package is available that resolves this issue...

CVE-2026-84304 affecting package azcopy for versions less than 10.25.1-9

CVE-2026-84304 affecting package azcopy for versions less than 10.25.1-9. An upgraded version of the package is available that resolves this issue...

SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:4125-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4125-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via...

azure-storage-azcopy-10.32.8-1.1 on GA media (moderate)

azure-storage-azcopy-10.32.8-1.1 on GA media Announcement ID: openSUSE-SU-2026:11740-1 Rating: moderate Cross-References: CVE-2026-84304 CVE-2026-84445 CVSS scores: CVE-2026-84304 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-84304 SUSE : 8.7...

SUSE-SU-2026:4125-1 Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276733. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation...

Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276733. CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issu...

OPENSUSE-SU-2026:11740-1 azure-storage-azcopy-10.32.8-1.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.8-1.1 package on the GA media of openSUSE Tumbleweed...

AZL-99150 CVE-2026-84304 affecting package azcopy for versions less than 10.25.1-9

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

OPENSUSE-SU-2026:11604-1 azure-storage-azcopy-10.32.7-1.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.7-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: opentofu, kubo, cluster-api, kube-fluentd-operator, azure-workload-identity-webhook, cloud-sql-proxy, dask-gateway, chisel, amazon-k8s-cni, continuity, istio, crossplane-provider-aws-lambda, cluster-api-helm-controller, nfs-subdir-external-provisioner, grafana-mimir,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, cluster-api-gcp-controller, kubo, opentofu, azure-workload-identity-webhook, dask-gateway, redka, chisel, osv-scanner, nfs-subdir-external-provisioner, crossplane-provider-aws-lambda, azure-service-operator,...

SUSE SLES15 Security Update : azure-storage-azcopy (SUSE-SU-2026:3528-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3528-1 advisory. Update to 10.32.6. Security issues fixed: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded...