SUSE-SU-2026:4628-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

openSUSE 16 Security Update : prometheus-blackbox_exporter (openSUSE-SU-2026:22026-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22026-1 advisory. Changes in prometheus-blackboxexporter: - CVE-2026-84304: Fix heap memory exhaustion OOM via HTTP/2 DATA frame fragmentation in gRPC-Go by bumpi...

OPENSUSE-SU-2026:22026-1 Security update for prometheus-blackbox_exporter

This update for prometheus-blackboxexporter fixes the following issues: Changes in prometheus-blackboxexporter: - CVE-2026-84304: Fix heap memory exhaustion OOM via HTTP/2 DATA frame fragmentation in gRPC-Go by bumping it to version 1.83.1 bsc1279126 - CVE-2026-39821: Fix potential validation...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

CVE-2026-71418

A flaw was found in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Its DNS-over-HTTP/2 processing incorrectly retains previously processed HTTP/2 DATA frame contents. A remote attacker can exploit this by sending multiple craft...

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

SUSE SLES15 Security Update : google-cloud-sap-agent (SUSE-SU-2026:4206-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4206-1 advisory. Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272128....

io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing t...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 DATA frame receive buffer handling, where each received fragment incurs per-fragment tracking and queue allocation overhead even while staying within the configured...

CVE-2026-84304

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CVE-2026-84304: Uncontrolled Resource Consumption

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows a...

SUSE CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...