Amazon Linux 2023 : ecs-init (ALAS2023-2026-3321)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3321 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each ent...

Amazon Linux 2 : ecs-init (ALASECS-2026-149)

The version of ecs-init installed on the remote host is prior to 1.108.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2026-149 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer m...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-3273)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3273 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage befor...

Amazon Linux 2023 : buildah (ALAS2023-2026-3256)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3256 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : captree, libcap, libcap-devel (ALAS2023-2026-3255)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3255 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : git-lfs (ALAS2023-2026-3322)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3322 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates...

Amazon Linux 2023 : skopeo, skopeo-tests (ALAS2023-2026-3254)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3254 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3270)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3270 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:22158-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22158-1 advisory. Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc126578...

Amazon Linux 2023 : cni-plugins (ALAS2023-2026-3258)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3258 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-3272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3272 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-3228)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3228 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

Amazon Linux 2 : oci-add-hooks (ALASECS-2026-147)

The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-147 advisory. The HTTP/2 server could refund connection-level flow control twice for the same data: Once when ...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2026-3271)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3271 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...

CLEANSTART-2026-IO40218 malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability...

CLEANSTART-2026-VU96918 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

CLEANSTART-2026-IW19449 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CLEANSTART-2026-IU54775 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details...

Important: curl

Issue Overview: During an upload, curl mishandles HTTP/2 RSTSTREAM received from the server with reason HTTP11REQUIRED or REFUSEDSTREAM leading to a use after free of a struct Curleasy object. CVE-2026-92392 Affected Packages: curl Issue Correction: Run dnf update curl --releasever 2023.12.202610...

Linux Distros Unpatched Vulnerability : CVE-2026-95620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to...