AZL-107532 CVE-2026-97032 affecting package jx 3.10.182-5

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107538 CVE-2026-78669 affecting package jx 3.10.182-5

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107541 CVE-2026-78663 affecting package jx 3.10.182-5

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107535 CVE-2026-78660 affecting package jx 3.10.182-5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107544 CVE-2026-78659 affecting package jx 3.10.182-5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-56852 affecting package jx for versions less than 3.10.182-5

CVE-2026-56852 affecting package jx for versions less than 3.10.182-5. A patched version of the package is available...

AZL-93207 CVE-2026-56852 affecting package jx for versions less than 3.10.182-5

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-39821 affecting package jx for versions less than 3.10.182-4

CVE-2026-39821 affecting package jx for versions less than 3.10.182-4. A patched version of the package is available...

AZL-87834 CVE-2026-39821 affecting package jx for versions less than 3.10.182-4

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

MINI-5V42-4JX4-QC75

Bulletin has no description...

CVE-2025-30204 affecting package jx for versions less than 3.2.236-25

CVE-2025-30204 affecting package jx for versions less than 3.2.236-25. A patched version of the package is available...

CVE-2025-65637 affecting package jx for versions less than 3.2.236-24

CVE-2025-65637 affecting package jx for versions less than 3.2.236-24. A patched version of the package is available...

CVE-2025-58058 affecting package jx for versions less than 3.10.182-3

CVE-2025-58058 affecting package jx for versions less than 3.10.182-3. A patched version of the package is available...

CVE-2025-58058 affecting package jx for versions less than 3.2.236-23

CVE-2025-58058 affecting package jx for versions less than 3.2.236-23. A patched version of the package is available...

EUVD-2007-2084

Malware in sbrugna...

AZL-66735 CVE-2025-58058 affecting package jx for versions less than 3.2.236-23

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

AZL-66753 CVE-2025-58058 affecting package jx for versions less than 3.10.182-3

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

CVE-2019-10339

A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfigurationdoValidateClient allowed users with Overall/Read access to have Jenkins connect to an attacker-specified Kubernetes server, potentially leaking credentials...

CVE-2024-51744 affecting package jx for versions less than 3.2.236-21

CVE-2024-51744 affecting package jx for versions less than 3.2.236-21. A patched version of the package is available...

AZL-77511 CVE-2025-30204 affecting package jx for versions less than 3.2.236-25

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...