102 matches found
AZL-111842 CVE-2026-97045 affecting package cf-cli 8.7.11-10
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
AZL-111839 CVE-2026-78661 affecting package cf-cli 8.7.11-9
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...
CVE-2026-78669 affecting package cf-cli for versions less than 8.7.11-10
CVE-2026-78669 affecting package cf-cli for versions less than 8.7.11-10. A patched version of the package is available...
CVE-2026-78660 affecting package cf-cli for versions less than 8.7.11-10
CVE-2026-78660 affecting package cf-cli for versions less than 8.7.11-10. A patched version of the package is available...
AZL-107198 CVE-2026-97032 affecting package cf-cli 8.7.11-9
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-107201 CVE-2026-78669 affecting package cf-cli for versions less than 8.7.11-10
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-107210 CVE-2026-78659 affecting package cf-cli 8.7.11-9
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107207 CVE-2026-78663 affecting package cf-cli 8.7.11-9
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107204 CVE-2026-78660 affecting package cf-cli for versions less than 8.7.11-10
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
CVE-2026-78662 affecting package cf-cli for versions less than 8.7.11-9
CVE-2026-78662 affecting package cf-cli for versions less than 8.7.11-9. A patched version of the package is available...
CVE-2026-56855 affecting package cf-cli for versions less than 8.7.11-9
CVE-2026-56855 affecting package cf-cli for versions less than 8.7.11-9. A patched version of the package is available...
CVE-2026-37236 affecting package cf-cli for versions less than 8.7.11-9
CVE-2026-37236 affecting package cf-cli for versions less than 8.7.11-9. A patched version of the package is available...
AZL-99165 CVE-2026-78662 affecting package cf-cli for versions less than 8.7.11-9
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
AZL-99168 CVE-2026-56855 affecting package cf-cli for versions less than 8.7.11-9
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...
OPENSUSE-SU-2026:11410-1 cf-cli-8.18.4+git.0.3fcd823a1-1.1 on GA media
These are all security issues fixed in the cf-cli-8.18.4+git.0.3fcd823a1-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8
CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8. A patched version of the package is available...
AZL-93144 CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
CVE-2026-39827 affecting package cf-cli for versions less than 8.7.11-7
CVE-2026-39827 affecting package cf-cli for versions less than 8.7.11-7. A patched version of the package is available...