19 matches found
AZL-111962 CVE-2026-116586 affecting package ignition-flatcar 2.22.0-6
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...
AZL-111959 CVE-2026-116585 affecting package ignition-flatcar 2.22.0-6
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...
CVE-2026-78660 affecting package ignition-flatcar for versions less than 2.22.0-7
CVE-2026-78660 affecting package ignition-flatcar for versions less than 2.22.0-7. A patched version of the package is available...
CVE-2026-78669 affecting package ignition-flatcar for versions less than 2.22.0-7
CVE-2026-78669 affecting package ignition-flatcar for versions less than 2.22.0-7. A patched version of the package is available...
AZL-107511 CVE-2026-97032 affecting package ignition-flatcar for versions less than 2.22.0-6
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-107505 CVE-2026-78669 affecting package ignition-flatcar 2.22.0-6
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-107514 CVE-2026-78659 affecting package ignition-flatcar for versions less than 2.22.0-6
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107502 CVE-2026-78660 affecting package ignition-flatcar 2.22.0-6
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107508 CVE-2026-78663 affecting package ignition-flatcar 2.22.0-6
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
CVE-2026-78659 affecting package ignition-flatcar for versions less than 2.22.0-6
CVE-2026-78659 affecting package ignition-flatcar for versions less than 2.22.0-6. A patched version of the package is available...
CVE-2026-56852 affecting package ignition-flatcar for versions less than 2.22.0-6
CVE-2026-56852 affecting package ignition-flatcar for versions less than 2.22.0-6. A patched version of the package is available...
CVE-2026-97032 affecting package ignition-flatcar for versions less than 2.22.0-6
CVE-2026-97032 affecting package ignition-flatcar for versions less than 2.22.0-6. A patched version of the package is available...
CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5
CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5. A patched version of the package is available...
CVE-2026-29181 affecting package ignition-flatcar for versions less than 2.22.0-5
CVE-2026-29181 affecting package ignition-flatcar for versions less than 2.22.0-5. A patched version of the package is available...
CVE-2026-39821 affecting package ignition-flatcar for versions less than 2.22.0-3
CVE-2026-39821 affecting package ignition-flatcar for versions less than 2.22.0-3. A patched version of the package is available...
AZL-87804 CVE-2026-39821 affecting package ignition-flatcar for versions less than 2.22.0-5
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
CVE-2026-27141 affecting package ignition-flatcar for versions less than 2.22.0-2
CVE-2026-27141 affecting package ignition-flatcar for versions less than 2.22.0-2. A patched version of the package is available...
AZL-86502 CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...