185 matches found
CVE-2026-78660 affecting package cri-tools for versions less than 1.32.0-10
CVE-2026-78660 affecting package cri-tools for versions less than 1.32.0-10. A patched version of the package is available...
CVE-2026-78669 affecting package cri-tools for versions less than 1.32.0-10
CVE-2026-78669 affecting package cri-tools for versions less than 1.32.0-10. A patched version of the package is available...
CVE-2026-84304 affecting package cri-tools for versions less than 1.32.0-9
CVE-2026-84304 affecting package cri-tools for versions less than 1.32.0-9. A patched version of the package is available...
AZL-107285 CVE-2026-97032 affecting package cri-tools 1.32.0-8
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-107291 CVE-2026-78669 affecting package cri-tools 1.32.0-8
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-107282 CVE-2026-78659 affecting package cri-tools 1.32.0-8
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107294 CVE-2026-78663 affecting package cri-tools 1.32.0-8
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107288 CVE-2026-78660 affecting package cri-tools 1.32.0-8
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
CLEANSTART-2026-VW33526 protojson
Security vulnerability affects the cri-tools package. The protojson...
CLEANSTART-2026-FR88036 norm
Security vulnerability affects the cri-tools package. A norm...
CLEANSTART-2026-SN04687 NewNTUnicodeString does not check for string length overflow
Security vulnerability affects the cri-tools package. NewNTUnicodeString does not check for string length overflow...
CLEANSTART-2026-UC74382 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing
Security vulnerability affects the cri-tools package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...
CLEANSTART-2026-PN99410 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer
Security vulnerability affects the cri-tools package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
CLEANSTART-2026-DA69813 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-OI09716 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-YY41698 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Security vulnerability affects the cri-tools package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...
CLEANSTART-2026-HP71482 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-MJ25147 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...
CLEANSTART-2026-WP33718 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
Security vulnerability affects the cri-tools package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...