Every CVE Search/ Get API key

CVE-2026-78659

HTTP/2 server memory exhaustion due to Trailer headers in net/http

7.5 HighFix available

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.87%Up 0.6 points since Oct 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
EUVDEUVD-2026-95419 7.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
EUVD-2026-95419
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 7.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
OSVALPINE-CVE-2026-78659 7.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
ALPINE-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-78659 7.5
Record
BELL-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-78659 7.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
DEBIAN-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 47 moreShow less
OSVUBUNTU-CVE-2026-78659 7.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
UBUNTU-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:86093 No score

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86093
Updated
2026-11-02
OSVALSA-2026:86196 No score

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86196
Updated
2026-11-02
OSVALSA-2026:86203 No score

Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86203
Updated
2026-11-02
OSVAZL-107021 No score

CVE-2026-78659 affecting package azl-otel-collector 0.127.0-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107021
Updated
2026-11-05
OSVAZL-107039 No score

CVE-2026-78659 affecting package buildah 1.43.1-3

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107039
Updated
2026-11-05
OSVAZL-107069 No score

CVE-2026-78659 affecting package cri-o 1.30.1-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107069
Updated
2026-11-05
OSVAZL-107087 No score

CVE-2026-78659 affecting package kata-containers-preview 3.27.0~preview2-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107087
Updated
2026-11-05
OSVAZL-107114 No score

CVE-2026-78659 affecting package podman 5.6.1-10

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107114
Updated
2026-11-05
OSVAZL-107135 No score

CVE-2026-78659 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-7

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107135
Updated
2026-11-06
OSVAZL-107159 No score

CVE-2026-78659 affecting package azcopy 10.25.1-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107159
Updated
2026-11-02
OSVAZL-107165 No score

CVE-2026-78659 affecting package azurelinux-image-tools for versions less than 1.7.0-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107165
Updated
2026-11-05
OSVAZL-107180 No score

CVE-2026-78659 affecting package cert-manager for versions less than 1.12.15-15

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107180
Updated
2026-11-05
OSVAZL-107210 No score

CVE-2026-78659 affecting package cf-cli 8.7.11-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107210
Updated
2026-11-02
OSVAZL-107216 No score

CVE-2026-78659 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107216
Updated
2026-11-05
OSVAZL-107240 No score

CVE-2026-78659 affecting package containerd2 for versions less than 2.3.7-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107240
Updated
2026-11-05
OSVAZL-107255 No score

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107255
Updated
2026-11-05
OSVAZL-107270 No score

CVE-2026-78659 affecting package coredns for versions less than 1.11.4-23

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107270
Updated
2026-11-06
OSVAZL-107282 No score

CVE-2026-78659 affecting package cri-tools 1.32.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107282
Updated
2026-11-02
OSVAZL-107306 No score

CVE-2026-78659 affecting package docker-buildx for versions less than 0.14.0-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107306
Updated
2026-11-05
OSVAZL-107339 No score

CVE-2026-78659 affecting package docker-cli 25.0.7-5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107339
Updated
2026-11-02
OSVAZL-107354 No score

CVE-2026-78659 affecting package docker-compose for versions less than 2.27.0-16

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107354
Updated
2026-11-05
OSVAZL-107375 No score

CVE-2026-78659 affecting package etcd for versions less than 3.5.35-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107375
Updated
2026-11-06
OSVAZL-107387 No score

CVE-2026-78659 affecting package flannel for versions less than 0.24.2-34

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107387
Updated
2026-11-05
OSVAZL-107409 No score

CVE-2026-78659 affecting package gh for versions less than 2.102.0-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107409
Updated
2026-11-05
OSVAZL-107430 No score

CVE-2026-78659 affecting package git-lfs for versions less than 3.6.1-7

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107430
Updated
2026-11-06
OSVAZL-107514 No score

CVE-2026-78659 affecting package ignition-flatcar for versions less than 2.22.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107514
Updated
2026-11-05
OSVAZL-107526 No score

CVE-2026-78659 affecting package influxdb for versions less than 2.7.5-22

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107526
Updated
2026-11-05
OSVAZL-107544 No score

CVE-2026-78659 affecting package jx for versions less than 3.10.182-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107544
Updated
2026-11-05
OSVAZL-107564 No score

CVE-2026-78659 affecting package kata-containers for versions less than 4.1.0.kata1-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107564
Updated
2026-11-05
OSVAZL-107582 No score

CVE-2026-78659 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107582
Updated
2026-11-05
OSVAZL-107601 No score

CVE-2026-78659 affecting package keda 2.14.1-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107601
Updated
2026-11-02
OSVAZL-107619 No score

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107619
Updated
2026-11-05
OSVAZL-107640 No score

CVE-2026-78659 affecting package kubernetes for versions less than 1.30.10-32

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107640
Updated
2026-11-05
OSVAZL-107670 No score

CVE-2026-78659 affecting package kubevirt for versions less than 1.8.4-4

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107670
Updated
2026-11-05
OSVAZL-107676 No score

CVE-2026-78659 affecting package kured for versions less than 1.15.0-7

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107676
Updated
2026-11-05
OSVAZL-107694 No score

CVE-2026-78659 affecting package libcontainers-common 20240213-3

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107694
Updated
2026-11-02
OSVAZL-107727 No score

CVE-2026-78659 affecting package moby-containerd-cc for versions less than 1.7.7-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107727
Updated
2026-11-05
OSVAZL-107742 No score

CVE-2026-78659 affecting package moby-engine 25.0.18-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107742
Updated
2026-11-05
OSVAZL-107766 No score

CVE-2026-78659 affecting package multus for versions less than 4.0.2-12

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107766
Updated
2026-11-05
OSVAZL-107778 No score

CVE-2026-78659 affecting package opa for versions less than 0.63.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107778
Updated
2026-11-06
OSVAZL-107790 No score

CVE-2026-78659 affecting package packer for versions less than 1.9.5-23

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107790
Updated
2026-11-05
OSVAZL-107817 No score

CVE-2026-78659 affecting package prometheus-adapter for versions less than 0.12.0-12

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107817
Updated
2026-11-05
OSVAZL-107835 No score

CVE-2026-78659 affecting package prometheus-node-exporter for versions less than 1.7.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107835
Updated
2026-11-05
OSVAZL-107838 No score

CVE-2026-78659 affecting package prometheus-process-exporter for versions less than 0.8.2-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107838
Updated
2026-11-05
OSVAZL-107868 No score

CVE-2026-78659 affecting package skopeo for versions less than 1.14.4-15

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107868
Updated
2026-11-05
OSVAZL-107892 No score

CVE-2026-78659 affecting package sriov-network-device-plugin 3.7.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107892
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
docker
Alpine:v3.24
 before 29.9.0-r0
29.9.0-r0
go
Alpine:v3.24
 before 1.26.9-r0
1.26.9-r0
go-toolset
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-bin
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-docs
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-misc
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-race
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-src
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-tests
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
Show 231 moreShow less
Affected packages
PackageAffectedFixed
go-toolset
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-bin
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-docs
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-misc
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-race
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-src
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-tests
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
delve
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.1-1.module_el8.10.0+4307+6e4cbc60
1.26.1-1.module_el8.10.0+4307+6e4cbc60
go-toolset
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-bin
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-docs
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-misc
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-race
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-src
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-tests
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
azl-otel-collector
Azure Linux:3
 through 0.127.0-1 None known
buildah
Azure Linux:3
 through 1.43.1-3 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
kata-containers-preview
Azure Linux:3
 through 3.27.0~preview2-2 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
application-gateway-kubernetes-ingress
Azure Linux:3
 before 1.7.7-7
1.7.7-7
azcopy
Azure Linux:3
 through 10.25.1-9 None known
azurelinux-image-tools
Azure Linux:3
 before 1.7.0-2
1.7.0-2
cert-manager
Azure Linux:3
 before 1.12.15-15
1.12.15-15
cf-cli
Azure Linux:3
 through 8.7.11-9 None known
cloud-provider-kubevirt
Azure Linux:3
 before 0.5.1-10
0.5.1-10
containerd2
Azure Linux:3
 before 2.3.7-1
2.3.7-1
containerized-data-importer
Azure Linux:3
 before 1.62.0-9
1.62.0-9
coredns
Azure Linux:3
 before 1.11.4-23
1.11.4-23
cri-tools
Azure Linux:3
 through 1.32.0-8 None known
docker-buildx
Azure Linux:3
 before 0.14.0-19
0.14.0-19
docker-cli
Azure Linux:3
 through 25.0.7-5 None known
docker-compose
Azure Linux:3
 before 2.27.0-16
2.27.0-16
etcd
Azure Linux:3
 before 3.5.35-1
3.5.35-1
flannel
Azure Linux:3
 before 0.24.2-34
0.24.2-34
gh
Azure Linux:3
 before 2.102.0-2
2.102.0-2
git-lfs
Azure Linux:3
 before 3.6.1-7
3.6.1-7
ignition-flatcar
Azure Linux:3
 before 2.22.0-6
2.22.0-6
influxdb
Azure Linux:3
 before 2.7.5-22
2.7.5-22
jx
Azure Linux:3
 before 3.10.182-6
3.10.182-6
kata-containers
Azure Linux:3
 before 4.1.0.kata1-2
4.1.0.kata1-2
kata-containers-cc
Azure Linux:3
 before 3.15.0.aks0-23
3.15.0.aks0-23
keda
Azure Linux:3
 through 2.14.1-19 None known
kube-vip-cloud-provider
Azure Linux:3
 before 0.0.10-11
0.0.10-11
kubernetes
Azure Linux:3
 before 1.30.10-32
1.30.10-32
kubevirt
Azure Linux:3
 before 1.8.4-4
1.8.4-4
kured
Azure Linux:3
 before 1.15.0-7
1.15.0-7
libcontainers-common
Azure Linux:3
 through 20240213-3 None known
moby-containerd-cc
Azure Linux:3
 before 1.7.7-19
1.7.7-19
moby-engine
Azure Linux:3
 through 25.0.18-1 None known
multus
Azure Linux:3
 before 4.0.2-12
4.0.2-12
opa
Azure Linux:3
 before 0.63.0-6
0.63.0-6
packer
Azure Linux:3
 before 1.9.5-23
1.9.5-23
prometheus-adapter
Azure Linux:3
 before 0.12.0-12
0.12.0-12
prometheus-node-exporter
Azure Linux:3
 before 1.7.0-6
1.7.0-6
prometheus-process-exporter
Azure Linux:3
 before 0.8.2-6
0.8.2-6
skopeo
Azure Linux:3
 before 1.14.4-15
1.14.4-15
sriov-network-device-plugin
Azure Linux:3
 through 3.7.0-8 None known
telegraf
Azure Linux:3
 before 1.31.0-35
1.31.0-35
vitess
Azure Linux:3
 before 19.0.4-16
19.0.4-16
golang
Azure Linux:3
 through 1.26.10-1 None known
golang
Azure Linux:3
 1.27.0 to 1.27.3-1 None known
gcc
Azure Linux:3
 through 13.2.0-7 None known
python-tensorboard
Azure Linux:3
 through 2.16.2-6 None known
tensorflow
Azure Linux:3
 through 2.16.1-11 None known
kubevirt-openvmm
Azure Linux:3
 through 1.9.0-1 None known
go
Alpaquita:23
 1.19.7-r0 up to 1.26.9-r0
1.26.9-r0
go
Alpaquita:25
 1.24.3-r0 up to 1.26.9-r0
1.26.9-r0
docker
Alpaquita:stream
 24.0.2-r0 up to 29.9.0-r0
29.9.0-r0
go
Alpaquita:stream
 1.20.5-r2 up to 1.27.2-r0
1.27.2-r0
go
BellSoft Hardened Containers:23
 1.19.7-r0 up to 1.26.9-r0
1.26.9-r0
go
BellSoft Hardened Containers:25
 1.24.3-r0 up to 1.26.9-r0
1.26.9-r0
go
BellSoft Hardened Containers:stream
 1.20.5-r2 up to 1.27.2-r0
1.27.2-r0
golang
Bitnami
 before 1.26.9, 1.27.0-0 up to 1.27.2
1.26.91.27.2
golang-1.19
Debian:12
 All versions, plus listed versions
1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2
Show 7 moreShow less
1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1
 None known
golang-1.24
Debian:13
 All versions, plus listed versions
1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2
Show 5 moreShow less
1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1
 None known
golang-1.26
Debian:14
 before 1.26.9-1, plus listed versions
1.26.0-11.26.1-11.26.2-11.26.2-21.26.2-3
Show 18 moreShow less
1.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26~rc2-11.26~rc3-11.26~rc3-2
1.26.9-1
golang-1.27
Debian:14
 before 1.27.2-1, plus listed versions
1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1
Show 4 moreShow less
1.27.2-1~bpo13+11.27~rc1-11.27~rc2-11.27~rc3-1
1.27.2-1
golang-golang-x-net
Debian:12
 All versions, plus listed versions
1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2
Show 23 moreShow less
1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-11:0.7.0+dfsg-1
 None known
golang-golang-x-net
Debian:13
 All versions, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 6 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-1
 None known
golang-golang-x-net
Debian:14
 before 1:0.60.0-1, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 5 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-1
1:0.60.0-1
stdlib
Go
 before 1.26.9
1.26.9
stdlib
Go
 1.27.0-0 up to 1.27.2
1.27.2
golang.org/x/net
Go
 before 0.60.0
0.60.0
golang
Mageia:10
From an advisory covering 14 CVEs
 before 1.26.9-1.mga10
1.26.9-1.mga10
golang.org/x/net
Root:Go
 before v0.55.0-aikido.4
v0.55.0-aikido.4v0.55.0-aikido.5v0.57.0-aikido.1v0.57.0-aikido.2v0.57.0-aikido.3v0.59.0-aikido.2v0.58.0-aikido.4v0.56.0-aikido.1v0.41.0-aikido.2v0.40.0-aikido.2v0.38.0-aikido.4v0.47.0-aikido.3v0.35.0-aikido.4v0.54.0-aikido.2v0.59.0-aikido.3v0.38.0-aikido.5v0.40.0-aikido.3v0.35.0-aikido.5v0.41.0-aikido.3v0.56.0-aikido.2v0.47.0-aikido.4v0.49.0-aikido.1v0.52.0-aikido.3v0.52.0-aikido.4v0.29.0-aikido.4v0.38.0-aikido.6v0.56.0-aikido.3v0.41.0-aikido.4v0.40.0-aikido.4v0.47.0-aikido.5v0.54.0-aikido.3v0.52.0-aikido.5v0.57.0-aikido.4v0.58.0-aikido.5v0.29.0-aikido.5v0.54.0-aikido.4v0.55.0-aikido.6v0.23.0-aikido.3v0.29.0-aikido.6v0.42.0-aikido.4v0.39.0-aikido.6
rootio-golang.org/x/net
Root:Go
 before v0.55.0-root.io.4
v0.55.0-root.io.4v0.55.0-root.io.5v0.57.0-root.io.1v0.57.0-root.io.2v0.57.0-root.io.3v0.59.0-root.io.2v0.58.0-root.io.4v0.56.0-root.io.1v0.41.0-root.io.2v0.40.0-root.io.2v0.38.0-root.io.4v0.47.0-root.io.3v0.35.0-root.io.4v0.54.0-root.io.2v0.59.0-root.io.3v0.38.0-root.io.5v0.40.0-root.io.3v0.35.0-root.io.5v0.41.0-root.io.3v0.56.0-root.io.2v0.47.0-root.io.4v0.49.0-root.io.1v0.52.0-root.io.3v0.52.0-root.io.4v0.58.0-root.io.5v0.29.0-root.io.4v0.38.0-root.io.6v0.56.0-root.io.3v0.41.0-root.io.4v0.40.0-root.io.4v0.47.0-root.io.5v0.54.0-root.io.3v0.52.0-root.io.5v0.57.0-root.io.4v0.29.0-root.io.5v0.54.0-root.io.4v0.55.0-root.io.6v0.23.0-root.io.3v0.29.0-root.io.6v0.42.0-root.io.4v0.39.0-root.io.6
go1.27
SUSE:Linux Enterprise Server 16.0
From an advisory covering 15 CVEs
 before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.27
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 15 CVEs
 before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.26
SUSE:Linux Enterprise Server 16.0
From an advisory covering 13 CVEs
 before 1.26.9-160000.1.1
1.26.9-160000.1.1
go1.26
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 13 CVEs
 before 1.26.9-160000.1.1
1.26.9-160000.1.1
google-guest-agent
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 20261022.00-159998.1.1
20261022.00-159998.1.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
 before 20261022.00-slfo.1.1_1.1
20261022.00-slfo.1.1_1.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.15-160000.5.1
3.15-160000.5.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.15-160000.5.1
3.15-160000.5.1
go1.27
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.26
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26-openssl
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 16 CVEs
 before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 16 CVEs
 before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
golang-1.10
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~14.04.1
 None known
golang-1.10
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2
 None known
golang-1.6
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
 None known
golang-golang-x-net-dev
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
 None known
juju-core
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.24.6-0ubuntu31.25.0-0ubuntu11.25.0-0ubuntu21.25.0-0ubuntu32.0~beta4-0ubuntu2
Show 12 moreShow less
2.0~beta6-0ubuntu1.16.04.12.0~beta7-0ubuntu1.16.04.12.0~beta12-0ubuntu1.16.04.12.0~beta15-0ubuntu2.16.04.12.0.0-0ubuntu0.16.04.22.0.2-0ubuntu0.16.04.12.0.2-0ubuntu0.16.04.22.3.1-0ubuntu0.16.04.12.3.2-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.1+esm12.3.7-0ubuntu0.16.04.1+esm2
 None known
lxd
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.20-0ubuntu40.21-0ubuntu30.21-0ubuntu50.22-0ubuntu10.22-0ubuntu2
Show 45 moreShow less
0.23-0ubuntu10.23-0ubuntu20.23-0ubuntu30.24-0ubuntu20.24-0ubuntu30.24-0ubuntu40.25-0ubuntu10.26-0ubuntu20.26-0ubuntu30.27-0ubuntu10.27-0ubuntu22.0.0~beta1-0ubuntu32.0.0~beta1-0ubuntu42.0.0~beta2-0ubuntu12.0.0~beta2-0ubuntu22.0.0~beta3-0ubuntu12.0.0~beta3-0ubuntu22.0.0~beta3-0ubuntu32.0.0~beta3-0ubuntu42.0.0~beta4-0ubuntu12.0.0~beta4-0ubuntu22.0.0~beta4-0ubuntu32.0.0~beta4-0ubuntu42.0.0~beta4-0ubuntu52.0.0~beta4-0ubuntu62.0.0~beta4-0ubuntu72.0.0~rc1-0ubuntu12.0.0~rc1-0ubuntu22.0.0~rc1-0ubuntu32.0.0~rc2-0ubuntu22.0.0~rc2-0ubuntu32.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc3-0ubuntu42.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc6-0ubuntu12.0.0~rc6-0ubuntu22.0.0~rc7-0ubuntu12.0.0~rc7-0ubuntu22.0.0~rc8-0ubuntu12.0.0~rc8-0ubuntu22.0.0~rc8-0ubuntu32.0.0~rc8-0ubuntu5
 None known
containerd
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.2.1-0ubuntu4~16.040.2.3-0ubuntu1~16.040.2.5-0ubuntu1~16.04.11.2.6-0ubuntu1~16.04.21.2.6-0ubuntu1~16.04.3
Show 9 moreShow less
1.2.6-0ubuntu1~16.04.41.2.6-0ubuntu1~16.04.51.2.6-0ubuntu1~16.04.61.2.6-0ubuntu1~16.04.6+esm11.2.6-0ubuntu1~16.04.6+esm21.2.6-0ubuntu1~16.04.6+esm41.2.6-0ubuntu1~16.04.6+esm51.2.6-0ubuntu1~16.04.6+esm61.2.6-0ubuntu1~16.04.6+esm7
 None known
golang-1.13
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3
 None known
golang-1.18
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.18.1-1ubuntu1~16.04.61.18.1-1ubuntu1~16.04.6+esm1
 None known
google-guest-agent
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~16.04.020230426.00-0ubuntu2~16.04.320231004.02-0ubuntu1~16.04.120231004.02-0ubuntu1~16.04.220240716.00-0ubuntu1~16.04.020240716.00-0ubuntu1~16.04.0+esm120240716.00-0ubuntu1~16.04.0+esm220240716.00-0ubuntu1~16.04.0+esm3
 None known
google-osconfig-agent
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
20210219.00-0ubuntu1~16.04.020230504.00-0ubuntu1~16.04.020240320.00-0ubuntu1~16.04.020240524.03-0ubuntu2~16.04.020251028.00-0ubuntu2~16.04.1
 None known
golang-1.10
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2
 None known
lxd
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.18-0ubuntu62.19-0ubuntu12.20-0ubuntu32.20-0ubuntu42.21-0ubuntu1
Show 18 moreShow less
2.21-0ubuntu22.21-0ubuntu32.21-0ubuntu43.0.0~beta2-0ubuntu33.0.0~beta3-0ubuntu33.0.0~beta5-0ubuntu23.0.0~beta7-0ubuntu13.0.0-0ubuntu13.0.0-0ubuntu23.0.0-0ubuntu33.0.0-0ubuntu43.0.1-0ubuntu1~18.04.13.0.2-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.23.0.3-0ubuntu1~18.04.2+esm13.0.3-0ubuntu1~18.04.2+esm23.0.3-0ubuntu1~18.04.2+esm3
 None known
containerd
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.2.5-0ubuntu21.2.6-0ubuntu1~18.04.11.2.6-0ubuntu1~18.04.21.3.3-0ubuntu1~18.04.11.3.3-0ubuntu1~18.04.2
Show 15 moreShow less
1.3.3-0ubuntu1~18.04.31.3.3-0ubuntu1~18.04.41.4.4-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.11.5.2-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.31.5.5-0ubuntu3~18.04.11.5.5-0ubuntu3~18.04.21.5.9-0ubuntu1~18.04.11.5.9-0ubuntu1~18.04.21.6.12-0ubuntu1~18.04.11.6.12-0ubuntu1~18.04.1+esm11.6.12-0ubuntu1~18.04.1+esm21.6.12-0ubuntu1~18.04.1+esm31.6.12-0ubuntu1~18.04.1+esm4
 None known
golang-1.13
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1
 None known
golang-1.16
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.16.2-0ubuntu1~18.04.21.16.2-0ubuntu1~18.04.2+esm1
 None known
golang-1.18
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.18.1-1ubuntu1~18.04.31.18.1-1ubuntu1~18.04.41.18.1-1ubuntu1~18.04.4+esm1
 None known
golang-1.8
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
 None known
golang-1.9
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1
 None known
golang-golang-x-net-dev
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm11:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
 None known
google-guest-agent
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~18.04.020210414.00-0ubuntu1~18.04.020210629.00-0ubuntu1~18.04.120220622.00-0ubuntu2~18.04.020220622.00-0ubuntu2~18.04.1
Show 8 moreShow less
20230426.00-0ubuntu2~18.04.020231004.02-0ubuntu1~18.04.220231004.02-0ubuntu1~18.04.320240716.00-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.0+esm120241011.01-0ubuntu1~18.04.0+esm220241011.01-0ubuntu1~18.04.0+esm3
 None known
google-osconfig-agent
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
20210219.00-0ubuntu1~18.04.020210608.1-0ubuntu1~18.04.120210608.1-0ubuntu1~18.04.220220824.00-0ubuntu1~18.04.120230504.00-0ubuntu1~18.04.0
Show 4 moreShow less
20240320.00-0ubuntu1~18.04.020240524.03-0ubuntu2~18.04.020240926.03-0ubuntu1~18.04.020251028.00-0ubuntu2~18.04.0
 None known
adsys
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
0.8~22.040.9.2~20.040.9.2~20.04.10.9.2~20.04.20.9.2~20.04.2ubuntu0.10.9.2~20.04.2ubuntu0.1+esm10.9.2~20.04.2ubuntu0.1+esm2
 None known
containerd
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2.10-0ubuntu11.3.2-0ubuntu11.3.3-0ubuntu11.3.3-0ubuntu21.3.3-0ubuntu2.1
Show 20 moreShow less
1.3.3-0ubuntu2.21.3.3-0ubuntu2.31.4.4-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.11.5.2-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.31.5.5-0ubuntu3~20.04.11.5.5-0ubuntu3~20.04.21.5.9-0ubuntu1~20.04.11.5.9-0ubuntu1~20.04.41.5.9-0ubuntu1~20.04.51.5.9-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.11.6.12-0ubuntu1~20.04.31.6.12-0ubuntu1~20.04.51.6.12-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.71.6.12-0ubuntu1~20.04.81.6.12-0ubuntu1~20.04.8+esm11.6.12-0ubuntu1~20.04.8+esm2
 None known
golang-1.13
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu1
Show 5 moreShow less
1.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2
 None known
golang-1.14
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.14~beta1-11.14~beta1-21.14~rc1-11.14-11.14.1-1
Show 4 moreShow less
1.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.2
 None known
google-guest-agent
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~20.04.020210414.00-0ubuntu1~20.04.020210629.00-0ubuntu1~20.04.020220622.00-0ubuntu2~20.04.020220622.00-0ubuntu2~20.04.2
Show 11 moreShow less
20230426.00-0ubuntu2~20.04.020231004.02-0ubuntu1~20.04.120231004.02-0ubuntu1~20.04.220231004.02-0ubuntu1~20.04.320231004.02-0ubuntu1~20.04.420240716.00-0ubuntu1~20.04.020241011.01-0ubuntu1~20.04.120250116.00-0ubuntu1~20.04.020250116.00-0ubuntu1~20.04.0+esm120250116.00-0ubuntu1~20.04.0+esm220250116.00-0ubuntu1~20.04.0+esm3
 None known
golang-1.16
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.2-0ubuntu1~20.041.16.2-0ubuntu1~20.04.11.16.2-0ubuntu1~20.04.1+esm1
 None known
golang-1.18
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.18.1-1ubuntu1~20.04.11.18.1-1ubuntu1~20.04.21.18.1-1ubuntu1~20.04.3
 None known
golang-1.20
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu0.1~20.041.20.3-1ubuntu0.1~20.04.1
 None known
golang-1.21
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.21.1-1~ubuntu20.04.11.21.1-1~ubuntu20.04.21.21.1-1~ubuntu20.04.3
 None known
golang-golang-x-net-dev
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm21:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
 None known
google-osconfig-agent
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
20210219.00-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.120220824.00-0ubuntu1~20.04.120230504.00-0ubuntu1~20.04.0
Show 6 moreShow less
20240320.00-0ubuntu1~20.04.020240320.00-0ubuntu1~20.04.120240524.03-0ubuntu2~20.04.020240926.03-0ubuntu1~20.04.020250115.01-0ubuntu1~20.04.020251028.00-0ubuntu2~20.04.0
 None known
lxd
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:0.71:0.81:0.91:0.10
 None known
adsys
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.7.10.7.1build10.80.8ubuntu10.8.1
Show 15 moreShow less
0.8.20.8.30.8.40.8.5~22.040.9.2~22.040.9.2~22.04.10.9.2~22.04.20.14.1~22.040.14.2~22.040.14.2~22.04ubuntu0.10.14.3~22.040.14.3~22.04ubuntu0.10.16.3~22.04.10.16.3~22.04.20.16.3~22.04.2ubuntu0.22.04.1
 None known
containerd
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.5.5-0ubuntu31.5.9-0ubuntu11.5.9-0ubuntu21.5.9-0ubuntu31.5.9-0ubuntu3.1
Show 9 moreShow less
1.6.12-0ubuntu1~22.04.11.6.12-0ubuntu1~22.04.31.6.12-0ubuntu1~22.04.51.6.12-0ubuntu1~22.04.61.6.12-0ubuntu1~22.04.71.6.12-0ubuntu1~22.04.81.6.12-0ubuntu1~22.04.91.6.12-0ubuntu1~22.04.101.6.12-0ubuntu1~22.04.11
 None known
golang-1.17
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.17-1ubuntu21.17.3-1ubuntu11.17.3-1ubuntu21.17.13-3ubuntu11.17.13-3ubuntu1.21.17.13-3ubuntu1.3
 None known
golang-1.18
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.18~beta1-0ubuntu11.18~beta2-1ubuntu11.18~beta2-1ubuntu21.18~rc1-1ubuntu11.18-1ubuntu1
Show 4 moreShow less
1.18.1-1ubuntu11.18.1-1ubuntu1.11.18.1-1ubuntu1.21.18.1-1ubuntu1.3
 None known
golang-1.20
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu0.1~22.041.20.3-1ubuntu0.1~22.04.1
 None known
golang-1.21
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.21.1-1~ubuntu22.04.11.21.1-1~ubuntu22.04.21.21.1-1~ubuntu22.04.31.21.1-1~ubuntu22.04.4
 None known
golang-1.22
Ubuntu:22.04:LTS
 before 1.22.2-2~22.04.4, plus listed versions
1.22.2-2~22.041.22.2-2~22.04.11.22.2-2~22.04.21.22.2-2~22.04.3
1.22.2-2~22.04.4
golang-1.23
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.23.1-1~22.041.23.1-1~22.04.21.23.1-1~22.04.3
 None known
golang-1.24
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu1~22.04.11.24.4-1ubuntu1~22.04.21.24.13-2~22.04.11.24.13-2~22.04.2
 None known
golang-1.25
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.25.14-1~ubuntu0.22.04.1
 None known
golang-1.26
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.26.8-1~ubuntu0.22.04.2
 None known
google-guest-agent
Ubuntu:22.04:LTS
 All versions, plus listed versions
20210629.00-0ubuntu120210629.00-0ubuntu220220104.00-0ubuntu120220104.00-0ubuntu220220622.00-0ubuntu2~22.04.0
Show 14 moreShow less
20220622.00-0ubuntu2~22.04.120230426.00-0ubuntu2~22.04.020231004.02-0ubuntu1~22.04.120231004.02-0ubuntu1~22.04.220231004.02-0ubuntu1~22.04.320231004.02-0ubuntu1~22.04.420231004.02-0ubuntu1~22.04.520240716.00-0ubuntu1~22.04.020241011.01-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.120250116.00-0ubuntu1~22.04.220250116.00-0ubuntu1~22.04.320250116.00-0ubuntu1~22.04.4
 None known
google-osconfig-agent
Ubuntu:22.04:LTS
 All versions, plus listed versions
20210608.1-0ubuntu120210608.1-0ubuntu220210608.1-0ubuntu320220824.00-0ubuntu1~22.04.120220824.00-0ubuntu1~22.04.2
Show 10 moreShow less
20230504.00-0ubuntu1~22.04.020230504.00-0ubuntu1~22.04.120240320.00-0ubuntu1~22.04.020240320.00-0ubuntu1~22.04.120240524.03-0ubuntu2~22.04.020240524.03-0ubuntu2~22.04.120240926.03-0ubuntu1~22.04.020250115.01-0ubuntu1~22.04.020251028.00-0ubuntu2~22.04.020251028.00-0ubuntu2~22.04.1
 None known
golang-1.13
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.1+esm11.13.8-1ubuntu2.22.04.2
 None known
golang-golang-x-net
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm21:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm31:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
 None known
adsys
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13.10.13.20.13.30.14.10.14.1build1
Show 8 moreShow less
0.14.1ubuntu0.24.04.10.14.2~24.040.14.2~24.04ubuntu0.10.14.3~24.040.14.3~24.04ubuntu0.10.16.3~24.04.10.16.3~24.04.20.16.3~24.04.2ubuntu0.24.04.1
 None known
golang-1.21
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.21.1-11.21.3-11.21.4-11.21.5-11.21.6-1
Show 6 moreShow less
1.21.7-11.21.7-21.21.8-11.21.8-1build11.21.9-11.21.9-1ubuntu0.1
 None known
golang-1.22
Ubuntu:24.04:LTS
 before 1.22.2-2ubuntu0.5, plus listed versions
1.22~rc1-21.22.0-11.22.0-21.22.1-11.22.1-1build1
Show 5 moreShow less
1.22.2-21.22.2-2ubuntu0.11.22.2-2ubuntu0.21.22.2-2ubuntu0.31.22.2-2ubuntu0.4
1.22.2-2ubuntu0.5
golang-1.23
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.23.1-1~24.041.23.1-1~24.04.1
 None known
golang-1.24
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu1~24.04.11.24.4-1ubuntu1~24.04.21.24.13-2~24.04.1
 None known
golang-1.25
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.25.14-1~ubuntu0.24.04.1
 None known
golang-1.26
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.26.8-1~ubuntu0.24.04.2
 None known
google-guest-agent
Ubuntu:24.04:LTS
 All versions, plus listed versions
20230426.00-0ubuntu320231004.02-0ubuntu120231004.02-0ubuntu320240213.00-0ubuntu120240213.00-0ubuntu2
Show 11 moreShow less
20240213.00-0ubuntu320240213.00-0ubuntu3.120240213.00-0ubuntu3.220240716.00-0ubuntu1~24.04.020240716.00-0ubuntu1~24.04.120241011.01-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.120250116.00-0ubuntu1~24.04.220250116.00-0ubuntu1~24.04.320250116.00-0ubuntu1~24.04.4
 None known
google-osconfig-agent
Ubuntu:24.04:LTS
 All versions, plus listed versions
20230504.00-0ubuntu220230504.00-0ubuntu320240320.00-0ubuntu1~24.04.020240320.00-0ubuntu1~24.04.120240320.00-0ubuntu1~24.04.2
Show 6 moreShow less
20240524.03-0ubuntu2~24.04.020240524.03-0ubuntu2~24.04.120240926.03-0ubuntu1~24.04.020250115.01-0ubuntu1~24.04.020250115.01-0ubuntu1~24.04.120251028.00-0ubuntu2~24.04.0
 None known
containerd
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.6.20~ds1-1ubuntu21.6.24~ds1-1ubuntu11.6.24~ds1-1ubuntu1.11.6.24~ds1-1ubuntu1.21.6.24~ds1-1ubuntu1.2+esm1
Show 4 moreShow less
1.6.24~ds1-1ubuntu1.31.6.24~ds1-1ubuntu1.3+esm11.6.24~ds1-1ubuntu1.3+esm21.6.24~ds1-1ubuntu1.3+esm3
 None known
golang-golang-x-net
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1:0.10.0-11:0.17.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.21.0+dfsg-1ubuntu0.1~esm11:0.21.0+dfsg-1ubuntu0.1~esm2
 None known
adsys
Ubuntu:26.10
 All versions, plus listed versions
0.16.4ubuntu10.16.4ubuntu20.17.0
 None known
containerd
Ubuntu:26.10
 All versions, plus listed versions
1.7.24~ds1-10ubuntu12.1.9+ds1-2ubuntu12.1.9+ds1-3ubuntu12.1.9+ds1-5ubuntu1
 None known
golang-1.26
Ubuntu:26.10
 All versions, plus listed versions
1.26.0-11.26.2-31.26.4-11.26.5-11.26.6-21.26.7-11.26.8-11.26.8-2
 None known
golang-1.27
Ubuntu:26.10
 All versions, plus listed versions
1.27~rc1-11.27~rc2-11.27~rc3-11.27.0-11.27.1-1
 None known
golang-golang-x-net
Ubuntu:26.10
 All versions, plus listed versions
1:0.27.0-21:0.57.0-11:0.58.0-1
 None known
google-guest-agent
Ubuntu:26.10
 All versions, plus listed versions
20250506.01-0ubuntu220250506.01-0ubuntu320260819.00+~20260819.00-0ubuntu1
 None known
google-osconfig-agent
Ubuntu:26.10
 All versions, plus listed versions
20251028.00-0ubuntu220251028.00-0ubuntu3
 None known
adsys
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.16.30.16.3ubuntu10.16.40.16.4ubuntu10.16.4ubuntu1.1
 None known
golang-1.23
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.23.10-1
 None known
golang-1.24
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu11.24.9-11.24.13-2
 None known
golang-1.25
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.25.0-0ubuntu11.25.7-21.25.14-1~ubuntu0.26.04.1
 None known
golang-1.26
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.26~rc3-21.26.0-11.26.8-1~ubuntu0.26.04.2
 None known
golang-golang-x-net
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:0.27.0-2
 None known
google-guest-agent
Ubuntu:26.04:LTS
 All versions, plus listed versions
20250506.01-0ubuntu120250506.01-0ubuntu220250506.01-0ubuntu2.1
 None known
google-osconfig-agent
Ubuntu:26.04:LTS
 All versions, plus listed versions
20250701.00-0ubuntu120251028.00-0ubuntu2
 None known
containerd
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.7.24~ds1-8ubuntu11.7.24~ds1-10ubuntu11.7.24~ds1-10ubuntu1+esm1
 None known
golang-1.22
Ubuntu:20.04:LTS
From an advisory covering 12 CVEs
 before 1.22.2-2~20.04.3, plus listed versions
1.22.2-2~20.04.11.22.2-2~20.04.2
1.22.2-2~20.04.3
golang-1.22
Ubuntu:22.04:LTS
From an advisory covering 12 CVEs
 before 1.22.2-2~22.04.4, plus listed versions
1.22.2-2~22.041.22.2-2~22.04.11.22.2-2~22.04.21.22.2-2~22.04.3
1.22.2-2~22.04.4
golang-1.22
Ubuntu:24.04:LTS
From an advisory covering 12 CVEs
 before 1.22.2-2ubuntu0.5, plus listed versions
1.22~rc1-21.22.0-11.22.0-21.22.1-11.22.1-1build1
Show 5 moreShow less
1.22.2-21.22.2-2ubuntu0.11.22.2-2ubuntu0.21.22.2-2ubuntu0.31.22.2-2ubuntu0.4
1.22.2-2ubuntu0.5
go1.26
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 1.26.9-1.1
1.26.9-1.1
go1.27
openSUSE:Tumbleweed
From an advisory covering 15 CVEs
 before 1.27.2-1.1
1.27.2-1.1
rclone
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 1.75.2-1.1
1.75.2-1.1
vexctl
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.4.4+git106.aa6ffc8-1.1
0.4.4+git106.aa6ffc8-1.1
containerized-data-importer1.65
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.65.0-4.1
1.65.0-4.1
kubevirt1.8
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 1.8.4-7.1
1.8.4-7.1
kubevirt1.9
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.9.1-2.1
1.9.1-2.1
buildpacks-cli
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.40.10-1.1
0.40.10-1.1
git-bug
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 0.11.0-3.1
0.11.0-3.1
amazon-cloudwatch-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.300073.2-2.1
1.300073.2-2.1
azure-storage-azcopy
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 10.34.1-1.1
10.34.1-1.1
distribution
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.1.2-3.1
3.1.2-3.1
google-guest-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 20261022.00-1.1
20261022.00-1.1
google-osconfig-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 20261022.00-1.1
20261022.00-1.1
timoni
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 0.36.0-1.1
0.36.0-1.1
fleet-cli
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.16.3-1.1
0.16.3-1.1
helm
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 4.3.1-3.1
4.3.1-3.1
tempo-cli
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 3.1.1-1.1
3.1.1-1.1
alloy
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 1.21.3-1.1
1.21.3-1.1
go1.27
openSUSE:Leap 16.0
From an advisory covering 15 CVEs
 before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.26
openSUSE:Leap 16.0
From an advisory covering 13 CVEs
 before 1.26.9-160000.1.1
1.26.9-160000.1.1
kubevirt1.9
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 1.9.1-160000.1.1
1.9.1-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affectedOSV
affected
affectedOSV
affected, aliases, facts, referencesOSV
affected, aliases, referencesOSV
aliases, aliases_more
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78659 is a high vulnerability (CVSS 7.5) in Go Standard Library Net/http, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in docker 29.9.0-r0.

References

Show 137 moreShow less
This page doesn't list everything

Left out here: 26 versions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 44 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open