CVE-2026-78660 affecting package kured for versions less than 1.15.0-7

CVE-2026-78660 affecting package kured for versions less than 1.15.0-7. A patched version of the package is available...

CVE-2026-78669 affecting package kured for versions less than 1.15.0-7

CVE-2026-78669 affecting package kured for versions less than 1.15.0-7. A patched version of the package is available...

CVE-2026-78659 affecting package kured for versions less than 1.15.0-7

CVE-2026-78659 affecting package kured for versions less than 1.15.0-7. A patched version of the package is available...

CVE-2026-97032 affecting package kured for versions less than 1.15.0-7

CVE-2026-97032 affecting package kured for versions less than 1.15.0-7. A patched version of the package is available...

AZL-107682 CVE-2026-97032 affecting package kured 1.15.0-6

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107685 CVE-2026-78669 affecting package kured 1.15.0-6

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107688 CVE-2026-78660 affecting package kured 1.15.0-6

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107676 CVE-2026-78659 affecting package kured 1.15.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107679 CVE-2026-78663 affecting package kured 1.15.0-6

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-56852 affecting package kured for versions less than 1.15.0-6

CVE-2026-56852 affecting package kured for versions less than 1.15.0-6. A patched version of the package is available...

AZL-93228 CVE-2026-56852 affecting package kured for versions less than 1.15.0-6

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CLEANSTART-2026-DG85765 Security fixes for CVE-2025-47911, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-58190, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27140, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, ghsa-pc3f-x583-g7j2 applied in versions: 1.20.0-r0

Multiple security vulnerabilities affect the kured package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-39821 affecting package kured for versions less than 1.15.0-5

CVE-2026-39821 affecting package kured for versions less than 1.15.0-5. A patched version of the package is available...

AZL-87984 CVE-2026-39821 affecting package kured for versions less than 1.15.0-5

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

CVE-2026-35469 affecting package kured for versions less than 1.15.0-4

CVE-2026-35469 affecting package kured for versions less than 1.15.0-4. A patched version of the package is available...

AZL-85688 CVE-2026-35469 affecting package kured for versions less than 1.15.0-5

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count ...

CVE-2025-11065 affecting package kured for versions less than 1.15.0-3

CVE-2025-11065 affecting package kured for versions less than 1.15.0-3. A patched version of the package is available...

CVE-2025-11065 affecting package kured for versions less than 1.14.2-7

CVE-2025-11065 affecting package kured for versions less than 1.14.2-7. A patched version of the package is available...

AZL-75452 CVE-2025-11065 affecting package kured for versions less than 1.15.0-3

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75500 CVE-2025-11065 affecting package kured for versions less than 1.14.2-7

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...