AZL-99168 CVE-2026-56855 affecting package cf-cli 8.7.11-8

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

OPENSUSE-SU-2026:11410-1 cf-cli-8.18.4+git.0.3fcd823a1-1.1 on GA media

These are all security issues fixed in the cf-cli-8.18.4+git.0.3fcd823a1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8

CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8. A patched version of the package is available...

AZL-93144 CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-39827 affecting package cf-cli for versions less than 8.7.11-7

CVE-2026-39827 affecting package cf-cli for versions less than 8.7.11-7. A patched version of the package is available...

CVE-2026-39828 affecting package cf-cli for versions less than 8.7.11-7

CVE-2026-39828 affecting package cf-cli for versions less than 8.7.11-7. A patched version of the package is available...

CVE-2026-39835 affecting package cf-cli for versions less than 8.7.11-7

CVE-2026-39835 affecting package cf-cli for versions less than 8.7.11-7. A patched version of the package is available...

CVE-2026-25680 affecting package cf-cli for versions less than 8.7.11-7

CVE-2026-25680 affecting package cf-cli for versions less than 8.7.11-7. A patched version of the package is available...

CVE-2026-42506 affecting package cf-cli for versions less than 8.7.11-6

CVE-2026-42506 affecting package cf-cli for versions less than 8.7.11-6. A patched version of the package is available...

CVE-2026-46597 affecting package cf-cli for versions less than 8.7.11-6

CVE-2026-46597 affecting package cf-cli for versions less than 8.7.11-6. A patched version of the package is available...

CVE-2026-39834 affecting package cf-cli for versions less than 8.7.11-6

CVE-2026-39834 affecting package cf-cli for versions less than 8.7.11-6. A patched version of the package is available...

CVE-2026-27136 affecting package cf-cli for versions less than 8.7.11-6

CVE-2026-27136 affecting package cf-cli for versions less than 8.7.11-6. A patched version of the package is available...

CVE-2026-39821 affecting package cf-cli for versions less than 8.7.11-6

CVE-2026-39821 affecting package cf-cli for versions less than 8.7.11-6. A patched version of the package is available...

AZL-87471 CVE-2026-27136 affecting package cf-cli for versions less than 8.7.11-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87456 CVE-2026-42502 affecting package cf-cli for versions less than 8.7.11-7

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87477 CVE-2026-42506 affecting package cf-cli for versions less than 8.7.11-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87438 CVE-2026-39821 affecting package cf-cli for versions less than 8.7.11-6

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-87480 CVE-2026-25681 affecting package cf-cli for versions less than 8.7.11-7

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87459 CVE-2026-25680 affecting package cf-cli for versions less than 8.7.11-7

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-87444 CVE-2026-46597 affecting package cf-cli for versions less than 8.7.11-6

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...