AZL-111881 CVE-2026-116591 affecting package containerized-data-importer 1.62.0-8

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

AZL-111875 CVE-2026-116586 affecting package containerized-data-importer 1.62.0-9

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

PT-2026-122904

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-4.1 package on the GA media of openSUSE Tumbleweed...

AZL-109935 CVE-2026-114236 affecting package containerized-data-importer 1.62.0-9

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...

CVE-2026-61801 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-61801 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78669 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78669 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78660 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78660 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-97032 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-97032 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

AZL-107258 CVE-2026-97032 affecting package containerized-data-importer 1.62.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107252 CVE-2026-78669 affecting package containerized-data-importer 1.62.0-8

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107255 CVE-2026-78659 affecting package containerized-data-importer 1.62.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107264 CVE-2026-78663 affecting package containerized-data-importer 1.62.0-8

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107249 CVE-2026-78660 affecting package containerized-data-importer 1.62.0-8

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107261 CVE-2026-61801 affecting package containerized-data-importer 1.62.0-8

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-84445 affecting package containerized-data-importer for versions less than 1.62.0-8

CVE-2026-84445 affecting package containerized-data-importer for versions less than 1.62.0-8. A patched version of the package is available...

CVE-2026-84304 affecting package containerized-data-importer for versions less than 1.62.0-8

CVE-2026-84304 affecting package containerized-data-importer for versions less than 1.62.0-8. A patched version of the package is available...

SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:4209-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4209-1 advisory. - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory bsc1248946. - CVE-2026-25680: golang.org/x/net/html...

Security update for containerized-data-importer

This update for containerized-data-importer fixes the following issues: CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory bsc1248946. CVE-2026-25680: golang.org/x/net/html: denial of service when parsing arbitrary HTML bsc1267176. CVE-2026-25681: golang.org/x/net/html:...