AZL-112073 CVE-2026-116591 affecting package moby-containerd-cc 1.7.7-19

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

AZL-112076 CVE-2026-116586 affecting package moby-containerd-cc 1.7.7-19

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

AZL-108008 CVE-2026-95838 affecting package moby-containerd-cc for versions less than 1.7.7-19

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

CVE-2026-84304 affecting package moby-containerd-cc for versions less than 1.7.7-18

CVE-2026-84304 affecting package moby-containerd-cc for versions less than 1.7.7-18. A patched version of the package is available...

CVE-2026-81869 affecting package moby-containerd-cc for versions less than 1.7.7-18

CVE-2026-81869 affecting package moby-containerd-cc for versions less than 1.7.7-18. A patched version of the package is available...

CVE-2026-53493 affecting package moby-containerd-cc for versions less than 1.7.7-18

CVE-2026-53493 affecting package moby-containerd-cc for versions less than 1.7.7-18. A patched version of the package is available...

AZL-107715 CVE-2026-97032 affecting package moby-containerd-cc for versions less than 1.7.7-19

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107718 CVE-2026-78669 affecting package moby-containerd-cc for versions less than 1.7.7-19

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107727 CVE-2026-78659 affecting package moby-containerd-cc for versions less than 1.7.7-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107721 CVE-2026-78660 affecting package moby-containerd-cc for versions less than 1.7.7-19

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107724 CVE-2026-78663 affecting package moby-containerd-cc for versions less than 1.7.7-19

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-37236 affecting package moby-containerd-cc for versions less than 1.7.7-17

CVE-2026-37236 affecting package moby-containerd-cc for versions less than 1.7.7-17. A patched version of the package is available...

AZL-104081 CVE-2026-53493 affecting package moby-containerd-cc for versions less than 1.7.7-19

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runtime instability...

AZL-99279 CVE-2026-84304 affecting package moby-containerd-cc for versions less than 1.7.7-19

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-98385 CVE-2026-37236 affecting package moby-containerd-cc for versions less than 1.7.7-17

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

AZL-93261 CVE-2026-56852 affecting package moby-containerd-cc for versions less than 1.7.7-16

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-46680 affecting package moby-containerd-cc for versions less than 1.7.7-15

CVE-2026-46680 affecting package moby-containerd-cc for versions less than 1.7.7-15. A patched version of the package is available...

CVE-2026-53488 affecting package moby-containerd-cc for versions less than 1.7.7-15

CVE-2026-53488 affecting package moby-containerd-cc for versions less than 1.7.7-15. A patched version of the package is available...

CVE-2026-39821 affecting package moby-containerd-cc for versions less than 1.7.7-13

CVE-2026-39821 affecting package moby-containerd-cc for versions less than 1.7.7-13. A patched version of the package is available...

AZL-88059 CVE-2026-39821 affecting package moby-containerd-cc for versions less than 1.7.7-13

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...