149085 matches found
AZL-107640 CVE-2026-78659 affecting package kubernetes for versions less than 1.30.10-32
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107039 CVE-2026-78659 affecting package buildah 1.43.1-3
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107159 CVE-2026-78659 affecting package azcopy 10.25.1-9
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107925 CVE-2026-78660 affecting package telegraf for versions less than 1.31.0-35
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107544 CVE-2026-78659 affecting package jx for versions less than 3.10.182-6
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107805 CVE-2026-78660 affecting package packer for versions less than 1.9.5-23
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-108540 CVE-2026-78659 affecting package tensorflow 2.16.1-11
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107393 CVE-2026-78660 affecting package flannel for versions less than 0.24.2-34
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107892 CVE-2026-78659 affecting package sriov-network-device-plugin 3.7.0-8
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107937 CVE-2026-78663 affecting package vitess 19.0.4-14
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107760 CVE-2026-78663 affecting package multus 4.0.2-11
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107564 CVE-2026-78659 affecting package kata-containers for versions less than 4.1.0.kata1-2
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107625 CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107021 CVE-2026-78659 affecting package azl-otel-collector 0.127.0-1
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107207 CVE-2026-78663 affecting package cf-cli 8.7.11-9
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107778 CVE-2026-78659 affecting package opa for versions less than 0.63.0-6
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107526 CVE-2026-78659 affecting package influxdb for versions less than 2.7.5-22
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107790 CVE-2026-78659 affecting package packer for versions less than 1.9.5-23
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
ALPINE-CVE-2026-78663
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-107895 CVE-2026-78663 affecting package sriov-network-device-plugin 3.7.0-8
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...