AZL-107898 CVE-2026-97032 affecting package sriov-network-device-plugin 3.7.0-8

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107889 CVE-2026-78669 affecting package sriov-network-device-plugin 3.7.0-8

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107901 CVE-2026-78660 affecting package sriov-network-device-plugin 3.7.0-8

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107895 CVE-2026-78663 affecting package sriov-network-device-plugin 3.7.0-8

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107892 CVE-2026-78659 affecting package sriov-network-device-plugin 3.7.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-84445 affecting package sriov-network-device-plugin for versions less than 3.7.0-8

CVE-2026-84445 affecting package sriov-network-device-plugin for versions less than 3.7.0-8. An upgraded version of the package is available that resolves this issue...

CVE-2026-84304 affecting package sriov-network-device-plugin for versions less than 3.7.0-8

CVE-2026-84304 affecting package sriov-network-device-plugin for versions less than 3.7.0-8. An upgraded version of the package is available that resolves this issue...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: buildah, falco-no-driver, kubernetes, nvidia-container-toolkit, podman, grafana-alloy, node-feature-discovery, sriov-network-device-plugin, k3s...

GO-2026-5761 vulnerabilities

Vulnerabilities for packages: buildah, falco-no-driver, cadvisor, nvidia-container-toolkit, docker-machine-driver-harvester, podman, node-feature-discovery, sriov-network-device-plugin, k8s-device-plugin...

AZL-93318 CVE-2026-56852 affecting package sriov-network-device-plugin for versions less than 3.7.0-7

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GHSA-XJVP-4FHW-GC47 vulnerabilities

Vulnerabilities for packages: buildah, falco-no-driver, cadvisor, nvidia-container-toolkit, docker-machine-driver-harvester, podman, node-feature-discovery, sriov-network-device-plugin, k8s-device-plugin...

CVE-2026-25681 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

CVE-2026-25681 affecting package sriov-network-device-plugin for versions less than 3.7.0-6. A patched version of the package is available...

CVE-2026-42506 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

CVE-2026-42506 affecting package sriov-network-device-plugin for versions less than 3.7.0-6. A patched version of the package is available...

AZL-88290 CVE-2026-39821 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-88302 CVE-2026-42506 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88299 CVE-2026-42502 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88308 CVE-2026-27136 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88296 CVE-2026-25681 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-88293 CVE-2026-25680 affecting package sriov-network-device-plugin for versions less than 3.7.0-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CVE-2025-58190 affecting package sriov-network-device-plugin for versions less than 3.7.0-5

CVE-2025-58190 affecting package sriov-network-device-plugin for versions less than 3.7.0-5. A patched version of the package is available...