AZL-99204 CVE-2026-84304 affecting package docker-compose 2.27.0-13

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99267 CVE-2026-84304 affecting package libcontainers-common 20240213-3

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99140 CVE-2026-84304 affecting package podman 5.6.1-10

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99375 CVE-2026-84304 affecting package skopeo 1.14.4-12

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99099 CVE-2026-84304 affecting package azl-otel-collector 0.127.0-1

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99324 CVE-2026-84304 affecting package packer 1.9.5-20

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99153 CVE-2026-84304 affecting package azurelinux-image-tools 1.6.0-2

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99119 CVE-2026-84304 affecting package buildah 1.43.1-3

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

EUVD-2026-69420

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CVE-2026-75538 A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer

An attacker that connects to an open Erlang TCP port that uses the inet driver with packet,4 mode can use a signed overflow in an incorrect packet length calculation to overflow the receive buffer into the VM allocator area and beyond up to about 2 GB. This would easily trash the allocated block'...

PT-2026-84290

Name of the Vulnerable Software and Affected Versions NetStaX EtherNet/IP Stack versions prior to 5.6.1 Description An issue exists where a large Class 3 explicit-message request can exceed the application-side receive buffer without triggering an error or warning. This can lead to memory...

PT-2026-84532

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A Server-Side Request Forgery SSRF issue exists where insufficient network isolation allows malicious pre-receive hook code to impersonate an internal service. This enables the...

CVE-2026-80654

A flaw was found in the Linux kernel. An incorrect condition check during the cleanup of a mailbox receive channel in the soc: xilinx component allows the channel to remain active and receive messages even after the device has been removed. This oversight leads to a use-after-free vulnerability,...

CVE-2026-80707

A flaw was found in the Linux kernel's J1939 CAN bus transport module. When a new session's receive buffer is allocated, it is not properly initialized, which can leave residual data from previous memory usage. A local attacker could potentially exploit this to read sensitive information from the...

CVE-2026-80707

In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939sessionfreshnew: initialize receive buffer Zero the allocated buffer in j1939sessionfreshnew to ensure it contains no residual data. While there is a potential performance impact if users allocate...

CVE-2026-80707 can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939sessionfreshnew: initialize receive buffer Zero the allocated buffer in j1939sessionfreshnew to ensure it contains no residual data. While there is a potential performance impact if users allocate...

CVE-2026-80707 can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer

In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939sessionfreshnew: initialize receive buffer Zero the allocated buffer in j1939sessionfreshnew to ensure it contains no residual data. While there is a potential performance impact if users allocate...

SUSE CVE-2026-72464

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

SUSE CVE-2026-72466

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdmaisbcall decodes a reply's first words to decide whether the frame is a backchannel call. Two issues in that decode path let a short or malformed reply leak the receive buffer...

CVE-2026-80588

A flaw was found in the Linux kernel's Multipath TCP mptcp implementation. Errors occurring during the receive path, before data is queued, may prevent the system from reclaiming forward-allocated memory. This can lead to an unbounded increase in memory usage under certain network conditions, suc...