AZL-111896 CVE-2026-97045 affecting package cri-tools 1.32.0-10

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

AZL-111893 CVE-2026-78661 affecting package cri-tools 1.32.0-10

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

Amazon Linux 2 : cri-tools (ALAS-2026-4042)

The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4042 advisory. Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority...

CVE-2026-78660 affecting package cri-tools for versions less than 1.32.0-10

CVE-2026-78660 affecting package cri-tools for versions less than 1.32.0-10. A patched version of the package is available...

CVE-2026-78669 affecting package cri-tools for versions less than 1.32.0-10

CVE-2026-78669 affecting package cri-tools for versions less than 1.32.0-10. A patched version of the package is available...

CVE-2026-84304 affecting package cri-tools for versions less than 1.32.0-9

CVE-2026-84304 affecting package cri-tools for versions less than 1.32.0-9. A patched version of the package is available...

AZL-107285 CVE-2026-97032 affecting package cri-tools 1.32.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107291 CVE-2026-78669 affecting package cri-tools for versions less than 1.32.0-10

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107288 CVE-2026-78660 affecting package cri-tools for versions less than 1.32.0-10

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107294 CVE-2026-78663 affecting package cri-tools 1.32.0-8

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107282 CVE-2026-78659 affecting package cri-tools 1.32.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CLEANSTART-2026-VW33526 protojson

Security vulnerability affects the cri-tools package. The protojson...

CLEANSTART-2026-FR88036 norm

Security vulnerability affects the cri-tools package. A norm...

CLEANSTART-2026-SN04687 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the cri-tools package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-UC74382 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Security vulnerability affects the cri-tools package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

CLEANSTART-2026-PN99410 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the cri-tools package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-DA69813 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-OI09716 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-YY41698 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Security vulnerability affects the cri-tools package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...

CLEANSTART-2026-HP71482 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...