Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2023_5721)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235721 advisory. golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-44487 CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2023_0328)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230328 advisory. golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputil: ReverseProxy should not forward unparseable...

Rocky Linux 10.0 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource (crlsa-2025_8915)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20258915 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2022_5799)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225799 advisory. golang: compress/gzip: stack exhaustion in Reader.Read CVE-2022-30631 golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2024_1962)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241962 advisory. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 Tenable has extracted the preceding description block directly from...

Rocky Linux 10.0 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests (crlsa-2025_9149)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259149 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2025_9147)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259147 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_70640)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670640 advisory. buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56853 buildah: Go html/template: Cross-Site Scripting via...

Rocky Linux 10.0 [CIQ] Security Update: gvisor-tap-vsock / gvisor-tap-vsock-debuginfo / etc (crlsa-2025_9151)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259151 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_62407)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662407 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: weldr-client / weldr-client-debuginfo / weldr-client-debugsource (crlsa-2025_9635)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259635 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly from...

Rocky Linux 9 [CIQ] Security Update: containernetworking-plugins / containernetworking-plugins-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_70391)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670391 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2025_10672)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510672 advisory. net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo Multiple Vulnerabilities (crlsa-2023_5863)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235863 advisory. grafana: golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-39325 HTTP/2: Multiple HTTP/2 enabled web servers are...

Rocky Linux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772465492)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772465492 advisory. - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which caus...

AlmaLinux 9.2 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762538558)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762538558 advisory. - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.16 packages and security update

Red Hat OpenShift Container Platform release 4.22.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.22.16 security update

Red Hat build of MicroShift release 4.22.16 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...