CVE-2026-78669 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-78669 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-78660 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-78660 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-97032 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-97032 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-78659 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-78659 affecting package azurelinux-image-tools for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2026-81871 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-81871 affecting package azurelinux-image-tools for versions less than 1.7.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-81872 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-81872 affecting package azurelinux-image-tools for versions less than 1.7.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2026-81870 affecting package azurelinux-image-tools for versions less than 1.7.0-2

CVE-2026-81870 affecting package azurelinux-image-tools for versions less than 1.7.0-2. An upgraded version of the package is available that resolves this issue...

AZL-107171 CVE-2026-97032 affecting package azurelinux-image-tools 1.6.0-3

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107174 CVE-2026-78669 affecting package azurelinux-image-tools 1.6.0-3

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107168 CVE-2026-78663 affecting package azurelinux-image-tools 1.6.0-3

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107165 CVE-2026-78659 affecting package azurelinux-image-tools 1.6.0-3

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107177 CVE-2026-78660 affecting package azurelinux-image-tools 1.6.0-3

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

CVE-2026-84445 affecting package azurelinux-image-tools for versions less than 1.6.0-3

CVE-2026-84445 affecting package azurelinux-image-tools for versions less than 1.6.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2026-56852 affecting package azurelinux-image-tools for versions less than 1.5.0-2

CVE-2026-56852 affecting package azurelinux-image-tools for versions less than 1.5.0-2. A patched version of the package is available...

AZL-93111 CVE-2026-56852 affecting package azurelinux-image-tools for versions less than 1.5.0-2

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-33814 affecting package azurelinux-image-tools for versions less than 1.4.0-2

CVE-2026-33814 affecting package azurelinux-image-tools for versions less than 1.4.0-2. A patched version of the package is available...

CVE-2026-39824 affecting package azurelinux-image-tools for versions less than 1.4.0-1

CVE-2026-39824 affecting package azurelinux-image-tools for versions less than 1.4.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-39821 affecting package azurelinux-image-tools for versions less than 1.3.0-2

CVE-2026-39821 affecting package azurelinux-image-tools for versions less than 1.3.0-2. A patched version of the package is available...

AZL-87387 CVE-2026-39821 affecting package azurelinux-image-tools for versions less than 1.4.0-2

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...