47 matches found
Amazon Linux 2 : amazon-ecr-credential-helper (ALASECS-2026-146)
The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-146 advisory. The HTTP/2 server could refund connection-level flow control twice for the same data: Once when a...
Amazon Linux 2023 : soci-snapshotter (ALAS2023-2026-3270)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3270 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...
Amazon Linux 2 : oci-add-hooks (ALASECS-2026-147)
The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-147 advisory. The HTTP/2 server could refund connection-level flow control twice for the same data: Once when ...
Amazon Linux 2023 : credentials-fetcher (ALAS2023-2026-3228)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3228 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...
Amazon Linux 2023 : oci-add-hooks (ALAS2023-2026-3272)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3272 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map,...
Important: oci-add-hooks
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
Important: soci-snapshotter
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
Important: amazon-ecr-credential-helper
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
Amazon Linux 2 : oci-add-hooks (ALASNITRO-ENCLAVES-2026-127)
The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-127 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header...
Important: amazon-ecr-credential-helper
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
Important: oci-add-hooks
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2026-150)
The version of oci-add-hooks installed on the remote host is prior to 0-0.12.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-150 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values ...
Amazon Linux 2 : soci-snapshotter (ALASDOCKER-2026-148)
The version of soci-snapshotter installed on the remote host is prior to 0.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-148 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to populate th...
Amazon Linux 2 : amazon-ecr-credential-helper (ALASDOCKER-2026-149)
The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-149 advisory. When Trailer headers are sent by a client, the HTTP server internally uses the header values to...
Important: amazon-ecr-credential-helper
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
Important: credentials-fetcher
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
Important: soci-snapshotter
Issue Overview: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...
AZL-107264 CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107294 CVE-2026-78663 affecting package cri-tools 1.32.0-8
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107192 CVE-2026-78663 affecting package cert-manager for versions less than 1.12.15-15
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...