AZL-112091 CVE-2026-97045 affecting package multus 4.0.2-11

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

AZL-112088 CVE-2026-78661 affecting package multus 4.0.2-12

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

CVE-2026-78660 affecting package multus for versions less than 4.0.2-12

CVE-2026-78660 affecting package multus for versions less than 4.0.2-12. A patched version of the package is available...

CVE-2026-97032 affecting package multus for versions less than 4.0.2-12

CVE-2026-97032 affecting package multus for versions less than 4.0.2-12. A patched version of the package is available...

CVE-2026-78669 affecting package multus for versions less than 4.0.2-12

CVE-2026-78669 affecting package multus for versions less than 4.0.2-12. A patched version of the package is available...

CVE-2026-78659 affecting package multus for versions less than 4.0.2-12

CVE-2026-78659 affecting package multus for versions less than 4.0.2-12. A patched version of the package is available...

AZL-107763 CVE-2026-97032 affecting package multus for versions less than 4.0.2-12

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107754 CVE-2026-78669 affecting package multus for versions less than 4.0.2-12

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107757 CVE-2026-78660 affecting package multus for versions less than 4.0.2-12

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107760 CVE-2026-78663 affecting package multus 4.0.2-11

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107766 CVE-2026-78659 affecting package multus for versions less than 4.0.2-12

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-84304 affecting package multus for versions less than 4.0.2-11

CVE-2026-84304 affecting package multus for versions less than 4.0.2-11. A patched version of the package is available...

CLEANSTART-2025-KV52215 Security fix for GHSA-cg3q-j54f-5p7p applied in: multus-cni-fips 3.9.3-r2, nfs-subdir-external-provisioner-fips 4.0.16-r0, nfs-subdir-external-provisioner-fips 4.0.17-r0, nfs-subdir-external-provisioner-fips 4.0.18-r1

GHSA-cg3q-j54f-5p7p affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QG55054 Security fix for GHSA-4374-p667-p6c8 applied in: cfssl 1.5.0-r1, multus-cni-fips 3.9.3-r2, multus-cni-fips 4.0.2-r2, wavefront-collector-for-kubernetes 1.13.0-r0

GHSA-4374-p667-p6c8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD25563 Security fix for GHSA-vvpx-j8f3-3w6h applied in: cfssl 1.5.0-r1, multus-cni-fips 3.9.3-r2, wavefront-collector-for-kubernetes 1.13.0-r0

GHSA-vvpx-j8f3-3w6h affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2025-PK28736 Security fix for GHSA-ppp9-7jff-5vj2 applied in: multus-cni-fips 3.9.3-r2

Security vulnerability affects the multus-cni-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZF32543 Security fix for GHSA-gwc9-m7rh-j2ww applied in: cfssl 1.5.0-r1, multus-cni-fips 3.9.3-r2

GHSA-gwc9-m7rh-j2ww affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VD60296 Security fix for GHSA-8c26-wmh5-6g9v applied in: cfssl 1.5.0-r1, multus-cni-fips 3.9.3-r2

GHSA-8c26-wmh5-6g9v affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GW81743 Security fix for GHSA-83g2-8m93-v3w7 applied in: cfssl 1.5.0-r1, multus-cni-fips 3.9.3-r2

GHSA-83g2-8m93-v3w7 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PS41921 Security fix for GHSA-69ch-w2m2-3vjp applied in: multus-cni-fips 3.9.3-r2, wavefront-collector-for-kubernetes 1.13.0-r0

GHSA-69ch-w2m2-3vjp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...