CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC 認可ポリシーのバイパス: :path スラッシュ欠如 認可バイパス 説明 google.golang.org/grpc の authz パッケージは、:path 疑似ヘッダーに対して拒否ルールと許可ルールをマッチングさせる SDK レベルの RBAC 認可を実装しています。HTTP/2 サーバートランスポートは、クライアントから受け取った生の :path 値を、先頭が / で始まることを検証せずに格納します。ルーティング層 handleStream はディスパッチ前にパスを正規化しますが、RBAC エンジンは...

GHSA-2V4P-QF9Q-27WJ gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service DoS. Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This...

Security update for kubevirt, virt-pr-helper-container

This update for kubevirt, virt-pr-helper-container fixes the following issues: Changes in kubevirt: Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into place...

PT-2026-90826

This update for kubevirt, virt-pr-helper-container fixes the following issues: Changes in kubevirt: - Package the persistent-reservation helper's entrypoint script bsc1276520: virt-operator runs the pr-helper container with the command /entrypoint.sh, which symlinks the multipath socket into plac...

OESA-2026-3561 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

AZL-86396 CVE-2026-33814 affecting package buildah 1.43.1-3

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

AZL-86288 CVE-2026-33814 affecting package golang for versions less than 1.26.3-1

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

AZL-86502 CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...