PT-2026-122904

These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-4.1 package on the GA media of openSUSE Tumbleweed...

AZL-109935 CVE-2026-114236 affecting package containerized-data-importer 1.62.0-8

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...

CVE-2026-78669 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78669 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-97032 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-97032 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78660 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78660 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-61801 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-61801 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

AZL-107258 CVE-2026-97032 affecting package containerized-data-importer 1.62.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107252 CVE-2026-78669 affecting package containerized-data-importer 1.62.0-8

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107249 CVE-2026-78660 affecting package containerized-data-importer 1.62.0-8

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107255 CVE-2026-78659 affecting package containerized-data-importer 1.62.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107264 CVE-2026-78663 affecting package containerized-data-importer 1.62.0-8

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107261 CVE-2026-61801 affecting package containerized-data-importer 1.62.0-8

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-84304 affecting package containerized-data-importer for versions less than 1.62.0-8

CVE-2026-84304 affecting package containerized-data-importer for versions less than 1.62.0-8. A patched version of the package is available...

CVE-2026-84445 affecting package containerized-data-importer for versions less than 1.62.0-8

CVE-2026-84445 affecting package containerized-data-importer for versions less than 1.62.0-8. A patched version of the package is available...

SUSE SLES15 Security Update : containerized-data-importer (SUSE-SU-2026:4209-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4209-1 advisory. - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory bsc1248946. - CVE-2026-25680: golang.org/x/net/html...

Security update for containerized-data-importer

This update for containerized-data-importer fixes the following issues: CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory bsc1248946. CVE-2026-25680: golang.org/x/net/html: denial of service when parsing arbitrary HTML bsc1267176. CVE-2026-25681: golang.org/x/net/html:...

SUSE-SU-2026:4209-1 Security update for containerized-data-importer

This update for containerized-data-importer fixes the following issues: - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory bsc1248946. - CVE-2026-25680: golang.org/x/net/html: denial of service when parsing arbitrary HTML bsc1267176. - CVE-2026-25681:...

AZL-103137 CVE-2025-11395 affecting package containerized-data-importer 1.62.0-8

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...