AZL-87570 CVE-2026-25680 affecting package cri-tools for versions less than 1.32.0-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-87585 CVE-2026-25681 affecting package cri-tools for versions less than 1.32.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

CVE-2026-35469 affecting package cri-tools for versions less than 1.32.0-5

CVE-2026-35469 affecting package cri-tools for versions less than 1.32.0-5. A patched version of the package is available...

cri-tools-1.36.0-1.1 on GA media (moderate)

cri-tools-1.36.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10690-1 Rating: moderate Cross-References: CVE-2026-33186 CVSS scores: CVE-2026-33186 SUSE : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2026-33186 SUSE : 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:...

PT-2026-37364

These are all security issues fixed in the cri-tools-1.36.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10690-1 cri-tools-1.36.0-1.1 on GA media

These are all security issues fixed in the cri-tools-1.36.0-1.1 package on the GA media of openSUSE Tumbleweed...

AZL-85634 CVE-2026-35469 affecting package cri-tools for versions less than 1.32.0-6

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count ...

Amazon Linux 2 : cri-tools, --advisory ALAS2-2026-3236 (ALAS-2026-3236)

"The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3236 advisory. The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negati...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: redpanda, witness, dagger, cri-tools, mcp-grafana, dgraph, terraform-mcp-server, rclone, k3s, opentelemetry-collector-contrib, weaviate, prometheus, kubevela, grafana, nfpm, k8sgpt, nuclei, minio, terragrunt, lazygit, vcluster, maru, malcontent, teleport,...

CVE-2025-47911 affecting package cri-tools for versions less than 1.32.0-4

CVE-2025-47911 affecting package cri-tools for versions less than 1.32.0-4. A patched version of the package is available...

CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4

CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4. A patched version of the package is available...

CVE-2025-58190 affecting package cri-tools for versions less than 1.29.0-9

CVE-2025-58190 affecting package cri-tools for versions less than 1.29.0-9. A patched version of the package is available...

CVE-2025-47911 affecting package cri-tools for versions less than 1.29.0-9

CVE-2025-47911 affecting package cri-tools for versions less than 1.29.0-9. A patched version of the package is available...

AZL-76919 CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76851 CVE-2025-58190 affecting package cri-tools for versions less than 1.29.0-9

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76916 CVE-2025-47911 affecting package cri-tools for versions less than 1.32.0-4

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76848 CVE-2025-47911 affecting package cri-tools for versions less than 1.29.0-9

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

Amazon Linux 2 : cri-tools, --advisory ALAS2-2026-3135 (ALAS-2026-3135)

The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3135 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary Z...

Medium: cri-tools

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

Amazon Linux 2 : cri-tools, --advisory ALAS2-2025-3097 (ALAS-2025-3097)

The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3097 advisory. crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a...