AZL-88083 CVE-2026-46597 affecting package moby-engine for versions less than 25.0.3-18

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87696 CVE-2026-46597 affecting package docker-compose for versions less than 2.27.0-11

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87630 CVE-2026-46597 affecting package docker-buildx for versions less than 0.14.0-13

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-88311 CVE-2026-46597 affecting package telegraf for versions less than 1.31.0-22

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87194 CVE-2026-46597 affecting package buildah 1.43.1-3

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87278 CVE-2026-46597 affecting package podman 5.6.1-10

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87981 CVE-2026-46597 affecting package kubevirt for versions less than 1.7.1-7

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87254 CVE-2026-46597 affecting package cri-o 1.30.1-1

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87444 CVE-2026-46597 affecting package cf-cli for versions less than 8.7.11-6

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-88182 CVE-2026-46597 affecting package packer for versions less than 1.9.5-15

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CVE-2026-46597

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87900 CVE-2026-46597 affecting package kubernetes for versions less than 1.30.10-25

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

AZL-87627 CVE-2026-39835 affecting package docker-buildx for versions less than 0.14.0-15

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

AZL-87975 CVE-2026-39835 affecting package kubevirt for versions less than 1.7.1-7

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

AZL-88071 CVE-2026-39835 affecting package moby-engine for versions less than 25.0.3-18

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

CVE-2026-39835

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

AZL-88332 CVE-2026-39835 affecting package telegraf for versions less than 1.31.0-23

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

AZL-87768 CVE-2026-39835 affecting package gh for versions less than 2.62.0-17

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

AZL-87191 CVE-2026-39835 affecting package buildah 1.43.1-3

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...

AZL-87308 CVE-2026-39835 affecting package podman 5.6.1-10

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...