134 matches found
AZL-107030 CVE-2026-97032 affecting package azl-otel-collector 0.127.0-1
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...
AZL-107027 CVE-2026-78669 affecting package azl-otel-collector 0.127.0-1
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...
AZL-107021 CVE-2026-78659 affecting package azl-otel-collector 0.127.0-1
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...
AZL-107033 CVE-2026-78660 affecting package azl-otel-collector 0.127.0-1
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...
AZL-107024 CVE-2026-78663 affecting package azl-otel-collector 0.127.0-1
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...
AZL-100971 CVE-2026-84445 affecting package azl-otel-collector 0.127.0-1
gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer allow internal/transport/http2server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go...
AZL-98253 CVE-2026-37236 affecting package azl-otel-collector 0.127.0-1
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
GO-2025-3788 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips...
GO-2025-3837 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips...
GO-2025-3839 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips...
GO-2025-3841 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips...
GO-2025-4071 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips...
GO-2026-5199 vulnerabilities
Vulnerabilities for packages: vault, splunk-otel-collector, vault-fips, splunk-otel-collector-fips...
GO-2026-5262 vulnerabilities
Vulnerabilities for packages: vault, splunk-otel-collector, vault-fips, splunk-otel-collector-fips...
GO-2026-5487 vulnerabilities
Vulnerabilities for packages: vault, splunk-otel-collector, vault-fips, splunk-otel-collector-fips...
GO-2025-3663 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips...
GO-2025-3924 vulnerabilities
Vulnerabilities for packages: vault, splunk-otel-collector, splunk-otel-collector-fips...
GO-2025-3836 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, splunk-otel-collector-fips...