AZL-99132 CVE-2026-84304 affecting package cri-o 1.30.1-1

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99140 CVE-2026-84304 affecting package podman 5.6.1-10

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99189 CVE-2026-84304 affecting package cri-tools 1.32.0-8

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99192 CVE-2026-84304 affecting package docker-buildx 0.14.0-17

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99219 CVE-2026-84304 affecting package gh for versions less than 2.101.0-1

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99240 CVE-2026-84304 affecting package kata-containers-cc for versions less than 3.15.0.aks0-21

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99291 CVE-2026-84304 affecting package multus for versions less than 4.0.2-11

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99375 CVE-2026-84304 affecting package skopeo for versions less than 1.14.4-13

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-99396 CVE-2026-84304 affecting package vitess for versions less than 19.0.4-14

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

EUVD-2026-69420

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CVE-2026-79921

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulti...

CVE-2026-26448

A flaw was found in Stomper. A remote attacker can trigger a use-after-free vulnerability by sending multiple CONNECT frames on the same TCP connection, followed by SEND frames to a previously subscribed destination. This can cause the broker to dereference a freed memory region, leading to a hea...

CVE-2026-26445

A flaw was found in stomper. A remote attacker can exploit this by sending partial STOMP Streaming Text Oriented Messaging Protocol frames. This action can cause the broker's sockets to enter a permanent half-read state. Consequently, the broker stops processing new messages, leading to a Denial ...

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame

A flaw was found in the HTTP/2 protocol implementation within the Go standard library golang.org/x/net and net/http/internal/http2. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP/2 SETTINGS frame with the SETTINGSMAXFRAMESIZE parameter set to zero. This...

Linux Distros Unpatched Vulnerability : CVE-2026-26445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the...

Important: libsoup

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

OESA-2026-3561 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

OESA-2026-3560 buildah security update

The package provides a command line tool which can be used to create a working container from scratch or create a working container from an image as a starting point mount/umount a working container's root file system for manipulation save container's root file system layer to create a new image...

OESA-2026-3553 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the...

SUSE CVE-2026-80725

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...