31 matches found
AZL-112064 CVE-2026-97045 affecting package kubevirt-openvmm 1.9.0-1
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...
AZL-112070 CVE-2026-78661 affecting package kubevirt-openvmm 1.9.0-1
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...
AZL-112067 CVE-2026-116591 affecting package kubevirt-openvmm 1.9.0-1
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...
AZL-111608 CVE-2026-97032 affecting package kubevirt-openvmm 1.9.0-1
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-111578 CVE-2026-78669 affecting package kubevirt-openvmm 1.9.0-1
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-111569 CVE-2026-78663 affecting package kubevirt-openvmm 1.9.0-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-111572 CVE-2026-78660 affecting package kubevirt-openvmm 1.9.0-1
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-111614 CVE-2026-78659 affecting package kubevirt-openvmm 1.9.0-1
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-111656 CVE-2026-93450 affecting package kubevirt-openvmm 1.9.0-1
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...
AZL-111584 CVE-2026-84445 affecting package kubevirt-openvmm 1.9.0-1
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...
AZL-111617 CVE-2026-78662 affecting package kubevirt-openvmm 1.9.0-1
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
AZL-111611 CVE-2026-56855 affecting package kubevirt-openvmm 1.9.0-1
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...
AZL-111650 CVE-2026-84304 affecting package kubevirt-openvmm 1.9.0-1
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
AZL-111554 CVE-2026-56852 affecting package kubevirt-openvmm 1.9.0-1
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
AZL-111581 CVE-2026-39824 affecting package kubevirt-openvmm 1.9.0-1
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...
AZL-111638 CVE-2026-42502 affecting package kubevirt-openvmm 1.9.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-111587 CVE-2026-42506 affecting package kubevirt-openvmm 1.9.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-111626 CVE-2026-27136 affecting package kubevirt-openvmm 1.9.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-111551 CVE-2026-39821 affecting package kubevirt-openvmm 1.9.0-1
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...
AZL-111548 CVE-2026-25681 affecting package kubevirt-openvmm 1.9.0-1
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...