50 matches found
CVE-2026-97032 affecting package containerd2 for versions less than 2.3.7-1
CVE-2026-97032 affecting package containerd2 for versions less than 2.3.7-1. A patched version of the package is available...
CVE-2026-78669 affecting package containerd2 for versions less than 2.3.7-1
CVE-2026-78669 affecting package containerd2 for versions less than 2.3.7-1. A patched version of the package is available...
CVE-2026-78660 affecting package containerd2 for versions less than 2.3.7-1
CVE-2026-78660 affecting package containerd2 for versions less than 2.3.7-1. A patched version of the package is available...
CVE-2026-61801 affecting package containerd2 for versions less than 2.3.7-1
CVE-2026-61801 affecting package containerd2 for versions less than 2.3.7-1. A patched version of the package is available...
CVE-2026-78659 affecting package containerd2 for versions less than 2.3.7-1
CVE-2026-78659 affecting package containerd2 for versions less than 2.3.7-1. A patched version of the package is available...
CVE-2026-53493 affecting package containerd2 for versions less than 2.3.6-1
CVE-2026-53493 affecting package containerd2 for versions less than 2.3.6-1. An upgraded version of the package is available that resolves this issue...
AZL-107237 CVE-2026-97032 affecting package containerd2 2.3.4-1
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-107234 CVE-2026-78669 affecting package containerd2 2.3.4-1
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-107231 CVE-2026-78660 affecting package containerd2 2.3.4-1
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107246 CVE-2026-78663 affecting package containerd2 2.3.4-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107240 CVE-2026-78659 affecting package containerd2 2.3.4-1
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107243 CVE-2026-61801 affecting package containerd2 2.3.4-1
The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...
CVE-2026-37236 affecting package containerd2 for versions less than 2.3.4-1
CVE-2026-37236 affecting package containerd2 for versions less than 2.3.4-1. A patched version of the package is available...
CVE-2026-56852 affecting package containerd2 for versions less than 2.2.4-6
CVE-2026-56852 affecting package containerd2 for versions less than 2.2.4-6. A patched version of the package is available...
AZL-93150 CVE-2026-56852 affecting package containerd2 for versions less than 2.2.4-6
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
CVE-2026-25681 affecting package containerd2 for versions less than 2.2.4-4
CVE-2026-25681 affecting package containerd2 for versions less than 2.2.4-4. A patched version of the package is available...
CVE-2026-25680 affecting package containerd2 for versions less than 2.2.4-4
CVE-2026-25680 affecting package containerd2 for versions less than 2.2.4-4. A patched version of the package is available...
CVE-2026-42502 affecting package containerd2 for versions less than 2.2.4-4
CVE-2026-42502 affecting package containerd2 for versions less than 2.2.4-4. A patched version of the package is available...