AZL-99252 CVE-2026-84304 affecting package kubernetes 1.30.10-30

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.12 security and extras update

Red Hat OpenShift Container Platform release 4.22.12 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

CVE-2026-84304: Uncontrolled Resource Consumption

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

TencentOS Server 4: rsyslog (TSSA-2026:0885)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0885 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

RHCOS 4 : Red Hat build of MicroShift 4.21.31 (RHSA-2026:60668)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:60668 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame CVE-2026-33814 No...

CVE-2026-26449

A flaw was found in Stomper. A remote attacker can send a specially crafted message, specifically a SEND frame missing the destination header field, to the server. This action triggers a null pointer dereference, which is an attempt to access memory that does not exist, causing the server process...

CVE-2026-80722

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. A remote attacker sending a specially crafted S1G TWT setup frame could cause the system to process an incomplete parameters block. This incomplete processing can lead to memory corruption or a system crash, resulting in a Denial of...

CVE-2026-80665

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. The kvmhandlevncrabort function incorrectly assumes that a specific translation result always indicates an abort, even when kvmtranslatevncr returns an error for a Guest Frame Number GFN...

Amazon Linux 2023 : libsoup3, libsoup3-devel (ALAS2023-2026-2087)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2087 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames...

Important: libsoup3

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

Linux Distros Unpatched Vulnerability : CVE-2026-26449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference or access to invalid...

Amazon Linux 2023 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2023-2026-2118)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2118 advisory. A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message lengt...

Important: libsoup

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

Linux Distros Unpatched Vulnerability : CVE-2026-47888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring...

Amazon Linux 2 : libsoup, --advisory ALAS2-2026-3876 (ALAS-2026-3876)

The version of libsoup installed on the remote host is prior to 2.56.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3876 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specifie...

Important: rsyslog

Issue Overview: A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege...

Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-2086)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2086 advisory. A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames...

OESA-2026-3554 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the...

OESA-2026-3504 rsyslog security update

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transfo...