Every CVE Search/ Get API key

CVE-2026-78660

HTTP/2 transport accepts malformed framing-related headers in net/http

7.5 HighFix available

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.54%Up 0.4 points since Oct 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

HTTP/2 transport accepts malformed framing-related headers in net/http

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
CVE-2026-78660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-95425 7.5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
EUVD-2026-95425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
NVD 7.5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
CVE-2026-78660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVALPINE-CVE-2026-78660 7.5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
ALPINE-CVE-2026-78660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2026-78660 7.5
Record
BELL-CVE-2026-78660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2026-78660 7.5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
DEBIAN-CVE-2026-78660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 47 moreShow less
OSVOESA-2026-4432 7.5

golang security update

.

Security Fix(es):

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.(CVE-2026-111943)

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.(CVE-2026-56866)

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.(CVE-2026-78660)

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.(CVE-2026-94440)

Record
OESA-2026-4432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-4433 7.5

golang security update

.

Security Fix(es):

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.(CVE-2026-111943)

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.(CVE-2026-56866)

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.(CVE-2026-78660)

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.(CVE-2026-94440)

Record
OESA-2026-4433
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-4434 7.5

golang security update

.

Security Fix(es):

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.(CVE-2026-56866)

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.(CVE-2026-78660)

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.(CVE-2026-94440)

Record
OESA-2026-4434
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-4435 7.5

golang security update

.

Security Fix(es):

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.(CVE-2026-111943)

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.(CVE-2026-56866)

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.(CVE-2026-78660)

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.(CVE-2026-94440)

Record
OESA-2026-4435
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-78660 7.5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
UBUNTU-CVE-2026-78660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2026:86093 No score

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86093
Updated
2026-11-02
OSVALSA-2026:86196 No score

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86196
Updated
2026-11-02
OSVALSA-2026:86203 No score

Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86203
Updated
2026-11-02
OSVAZL-107033 No score

CVE-2026-78660 affecting package azl-otel-collector 0.127.0-1

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107033
Updated
2026-11-05
OSVAZL-107036 No score

CVE-2026-78660 affecting package buildah 1.43.1-3

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107036
Updated
2026-11-05
OSVAZL-107054 No score

CVE-2026-78660 affecting package cri-o 1.30.1-1

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107054
Updated
2026-11-05
OSVAZL-107096 No score

CVE-2026-78660 affecting package kata-containers-preview 3.27.0~preview2-2

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107096
Updated
2026-11-05
OSVAZL-107105 No score

CVE-2026-78660 affecting package podman 5.6.1-10

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107105
Updated
2026-11-05
OSVAZL-107141 No score

CVE-2026-78660 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-7

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107141
Updated
2026-11-06
OSVAZL-107156 No score

CVE-2026-78660 affecting package azcopy for versions less than 10.25.1-10

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107156
Updated
2026-11-05
OSVAZL-107177 No score

CVE-2026-78660 affecting package azurelinux-image-tools for versions less than 1.7.0-2

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107177
Updated
2026-11-05
OSVAZL-107186 No score

CVE-2026-78660 affecting package cert-manager for versions less than 1.12.15-15

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107186
Updated
2026-11-05
OSVAZL-107204 No score

CVE-2026-78660 affecting package cf-cli for versions less than 8.7.11-10

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107204
Updated
2026-11-05
OSVAZL-107225 No score

CVE-2026-78660 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107225
Updated
2026-11-05
OSVAZL-107231 No score

CVE-2026-78660 affecting package containerd2 for versions less than 2.3.7-1

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107231
Updated
2026-11-05
OSVAZL-107249 No score

CVE-2026-78660 affecting package containerized-data-importer for versions less than 1.62.0-9

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107249
Updated
2026-11-05
OSVAZL-107267 No score

CVE-2026-78660 affecting package coredns for versions less than 1.11.4-23

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107267
Updated
2026-11-06
OSVAZL-107288 No score

CVE-2026-78660 affecting package cri-tools for versions less than 1.32.0-10

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107288
Updated
2026-11-05
OSVAZL-107312 No score

CVE-2026-78660 affecting package docker-buildx for versions less than 0.14.0-19

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107312
Updated
2026-11-05
OSVAZL-107342 No score

CVE-2026-78660 affecting package docker-cli 25.0.7-5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107342
Updated
2026-11-02
OSVAZL-107357 No score

CVE-2026-78660 affecting package docker-compose for versions less than 2.27.0-16

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107357
Updated
2026-11-05
OSVAZL-107372 No score

CVE-2026-78660 affecting package etcd for versions less than 3.5.35-1

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107372
Updated
2026-11-06
OSVAZL-107393 No score

CVE-2026-78660 affecting package flannel for versions less than 0.24.2-34

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107393
Updated
2026-11-05
OSVAZL-107418 No score

CVE-2026-78660 affecting package gh for versions less than 2.102.0-2

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107418
Updated
2026-11-05
OSVAZL-107424 No score

CVE-2026-78660 affecting package git-lfs for versions less than 3.6.1-7

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107424
Updated
2026-11-06
OSVAZL-107502 No score

CVE-2026-78660 affecting package ignition-flatcar for versions less than 2.22.0-7

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107502
Updated
2026-11-06
OSVAZL-107529 No score

CVE-2026-78660 affecting package influxdb for versions less than 2.7.5-21

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107529
Updated
2026-11-05
OSVAZL-107535 No score

CVE-2026-78660 affecting package jx for versions less than 3.10.182-6

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107535
Updated
2026-11-05
OSVAZL-107555 No score

CVE-2026-78660 affecting package kata-containers for versions less than 4.1.0.kata1-2

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107555
Updated
2026-11-05
OSVAZL-107574 No score

CVE-2026-78660 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107574
Updated
2026-11-05
OSVAZL-107598 No score

CVE-2026-78660 affecting package keda 2.14.1-19

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107598
Updated
2026-11-02
OSVAZL-107625 No score

CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107625
Updated
2026-11-05
OSVAZL-107637 No score

CVE-2026-78660 affecting package kubernetes for versions less than 1.30.10-32

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107637
Updated
2026-11-05
OSVAZL-107673 No score

CVE-2026-78660 affecting package kubevirt for versions less than 1.8.4-4

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107673
Updated
2026-11-05
OSVAZL-107688 No score

CVE-2026-78660 affecting package kured for versions less than 1.15.0-7

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107688
Updated
2026-11-05
OSVAZL-107706 No score

CVE-2026-78660 affecting package libcontainers-common 20240213-3

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107706
Updated
2026-11-02
OSVAZL-107721 No score

CVE-2026-78660 affecting package moby-containerd-cc for versions less than 1.7.7-19

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107721
Updated
2026-11-05
OSVAZL-107730 No score

CVE-2026-78660 affecting package moby-engine 25.0.18-1

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107730
Updated
2026-11-05
OSVAZL-107757 No score

CVE-2026-78660 affecting package multus for versions less than 4.0.2-12

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107757
Updated
2026-11-05
OSVAZL-107781 No score

CVE-2026-78660 affecting package opa for versions less than 0.63.0-6

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107781
Updated
2026-11-06
OSVAZL-107805 No score

CVE-2026-78660 affecting package packer for versions less than 1.9.5-23

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107805
Updated
2026-11-05
OSVAZL-107820 No score

CVE-2026-78660 affecting package prometheus-adapter for versions less than 0.12.0-12

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Record
AZL-107820
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
go
Alpine:v3.24
 before 1.26.9-r0
1.26.9-r0
go-toolset
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-bin
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-docs
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-misc
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-race
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-src
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-tests
AlmaLinux:10
From an advisory covering 15 CVEs
 before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
go-toolset
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
Show 228 moreShow less
Affected packages
PackageAffectedFixed
golang
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-bin
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-docs
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-misc
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-race
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-src
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-tests
AlmaLinux:9
From an advisory covering 15 CVEs
 before 1.26.10-1.el9_8
1.26.10-1.el9_8
delve
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.1-1.module_el8.10.0+4307+6e4cbc60
1.26.1-1.module_el8.10.0+4307+6e4cbc60
go-toolset
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-bin
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-docs
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-misc
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-race
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-src
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-tests
AlmaLinux:8
From an advisory covering 15 CVEs
 before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
azl-otel-collector
Azure Linux:3
 through 0.127.0-1 None known
buildah
Azure Linux:3
 through 1.43.1-3 None known
cri-o
Azure Linux:3
 through 1.30.1-1 None known
kata-containers-preview
Azure Linux:3
 through 3.27.0~preview2-2 None known
podman
Azure Linux:3
 through 5.6.1-10 None known
application-gateway-kubernetes-ingress
Azure Linux:3
 before 1.7.7-7
1.7.7-7
azcopy
Azure Linux:3
 before 10.25.1-10
10.25.1-10
azurelinux-image-tools
Azure Linux:3
 before 1.7.0-2
1.7.0-2
cert-manager
Azure Linux:3
 before 1.12.15-15
1.12.15-15
cf-cli
Azure Linux:3
 before 8.7.11-10
8.7.11-10
cloud-provider-kubevirt
Azure Linux:3
 before 0.5.1-10
0.5.1-10
containerd2
Azure Linux:3
 before 2.3.7-1
2.3.7-1
containerized-data-importer
Azure Linux:3
 before 1.62.0-9
1.62.0-9
coredns
Azure Linux:3
 before 1.11.4-23
1.11.4-23
cri-tools
Azure Linux:3
 before 1.32.0-10
1.32.0-10
docker-buildx
Azure Linux:3
 before 0.14.0-19
0.14.0-19
docker-cli
Azure Linux:3
 through 25.0.7-5 None known
docker-compose
Azure Linux:3
 before 2.27.0-16
2.27.0-16
etcd
Azure Linux:3
 before 3.5.35-1
3.5.35-1
flannel
Azure Linux:3
 before 0.24.2-34
0.24.2-34
gh
Azure Linux:3
 before 2.102.0-2
2.102.0-2
git-lfs
Azure Linux:3
 before 3.6.1-7
3.6.1-7
ignition-flatcar
Azure Linux:3
 before 2.22.0-7
2.22.0-7
influxdb
Azure Linux:3
 before 2.7.5-21
2.7.5-21
jx
Azure Linux:3
 before 3.10.182-6
3.10.182-6
kata-containers
Azure Linux:3
 before 4.1.0.kata1-2
4.1.0.kata1-2
kata-containers-cc
Azure Linux:3
 before 3.15.0.aks0-23
3.15.0.aks0-23
keda
Azure Linux:3
 through 2.14.1-19 None known
kube-vip-cloud-provider
Azure Linux:3
 before 0.0.10-11
0.0.10-11
kubernetes
Azure Linux:3
 before 1.30.10-32
1.30.10-32
kubevirt
Azure Linux:3
 before 1.8.4-4
1.8.4-4
kured
Azure Linux:3
 before 1.15.0-7
1.15.0-7
libcontainers-common
Azure Linux:3
 through 20240213-3 None known
moby-containerd-cc
Azure Linux:3
 before 1.7.7-19
1.7.7-19
moby-engine
Azure Linux:3
 through 25.0.18-1 None known
multus
Azure Linux:3
 before 4.0.2-12
4.0.2-12
opa
Azure Linux:3
 before 0.63.0-6
0.63.0-6
packer
Azure Linux:3
 before 1.9.5-23
1.9.5-23
prometheus-adapter
Azure Linux:3
 before 0.12.0-12
0.12.0-12
prometheus-node-exporter
Azure Linux:3
 before 1.7.0-6
1.7.0-6
prometheus-process-exporter
Azure Linux:3
 before 0.8.2-6
0.8.2-6
skopeo
Azure Linux:3
 before 1.14.4-15
1.14.4-15
sriov-network-device-plugin
Azure Linux:3
 before 3.7.0-9
3.7.0-9
telegraf
Azure Linux:3
 before 1.31.0-35
1.31.0-35
vitess
Azure Linux:3
 before 19.0.4-16
19.0.4-16
golang
Azure Linux:3
 through 1.26.10-1 None known
golang
Azure Linux:3
 1.27.0 to 1.27.3-1 None known
gcc
Azure Linux:3
 through 13.2.0-7 None known
python-tensorboard
Azure Linux:3
 through 2.16.2-6 None known
tensorflow
Azure Linux:3
 through 2.16.1-11 None known
kubevirt-openvmm
Azure Linux:3
 through 1.9.0-1 None known
go
Alpaquita:23
 1.19.7-r0 up to 1.26.9-r0
1.26.9-r0
go
Alpaquita:25
 1.24.3-r0 up to 1.26.9-r0
1.26.9-r0
go
Alpaquita:stream
 1.20.5-r2 up to 1.27.2-r0
1.27.2-r0
go
BellSoft Hardened Containers:23
 1.19.7-r0 up to 1.26.9-r0
1.26.9-r0
go
BellSoft Hardened Containers:25
 1.24.3-r0 up to 1.26.9-r0
1.26.9-r0
go
BellSoft Hardened Containers:stream
 1.20.5-r2 up to 1.27.2-r0
1.27.2-r0
golang
Bitnami
 before 1.26.9, 1.27.0-0 up to 1.27.2
1.26.91.27.2
golang-1.19
Debian:12
 All versions, plus listed versions
1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2
Show 7 moreShow less
1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1
 None known
golang-1.24
Debian:13
 All versions, plus listed versions
1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2
Show 5 moreShow less
1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1
 None known
golang-1.26
Debian:14
 before 1.26.9-1, plus listed versions
1.26.0-11.26.1-11.26.2-11.26.2-21.26.2-3
Show 18 moreShow less
1.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26~rc2-11.26~rc3-11.26~rc3-2
1.26.9-1
golang-1.27
Debian:14
 before 1.27.2-1, plus listed versions
1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1
Show 4 moreShow less
1.27.2-1~bpo13+11.27~rc1-11.27~rc2-11.27~rc3-1
1.27.2-1
golang-golang-x-net
Debian:12
 All versions, plus listed versions
1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2
Show 23 moreShow less
1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-11:0.7.0+dfsg-1
 None known
golang-golang-x-net
Debian:13
 All versions, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 6 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-1
 None known
golang-golang-x-net
Debian:14
 before 1:0.60.0-1, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 5 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-1
1:0.60.0-1
stdlib
Go
 before 1.26.9
1.26.9
stdlib
Go
 1.27.0-0 up to 1.27.2
1.27.2
golang.org/x/net
Go
 before 0.60.0
0.60.0
golang
Mageia:10
From an advisory covering 14 CVEs
 before 1.26.9-1.mga10
1.26.9-1.mga10
golang
openEuler:24.03-LTS-SP3
From an advisory covering 4 CVEs
 before 1.21.4-51.oe2403sp3
1.21.4-51.oe2403sp3
golang
openEuler:24.03-LTS-SP4
From an advisory covering 4 CVEs
 before 1.21.4-53.oe2403sp4
1.21.4-53.oe2403sp4
golang
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 1.17.3-52.oe2203sp4
1.17.3-52.oe2203sp4
golang
openEuler:24.03-LTS-SP1
From an advisory covering 4 CVEs
 before 1.21.4-48.oe2403sp1
1.21.4-48.oe2403sp1
golang.org/x/net
Root:Go
 before v0.55.0-aikido.3
v0.55.0-aikido.3v0.55.0-aikido.4v0.55.0-aikido.5v0.57.0-aikido.3v0.59.0-aikido.1v0.59.0-aikido.2v0.58.0-aikido.2v0.58.0-aikido.3v0.58.0-aikido.4v0.56.0-aikido.1v0.41.0-aikido.2v0.40.0-aikido.2v0.38.0-aikido.4v0.47.0-aikido.3v0.35.0-aikido.4v0.54.0-aikido.2v0.59.0-aikido.3v0.38.0-aikido.5v0.40.0-aikido.3v0.35.0-aikido.5v0.41.0-aikido.3v0.56.0-aikido.2v0.47.0-aikido.4v0.49.0-aikido.1v0.52.0-aikido.4v0.29.0-aikido.4v0.38.0-aikido.6v0.56.0-aikido.3v0.41.0-aikido.4v0.40.0-aikido.4v0.47.0-aikido.5v0.54.0-aikido.3v0.52.0-aikido.5v0.57.0-aikido.4v0.58.0-aikido.5v0.29.0-aikido.5v0.54.0-aikido.4v0.55.0-aikido.6v0.23.0-aikido.3v0.29.0-aikido.6
rootio-golang.org/x/net
Root:Go
 before v0.55.0-root.io.3
v0.55.0-root.io.3v0.55.0-root.io.4v0.55.0-root.io.5v0.57.0-root.io.3v0.59.0-root.io.1v0.59.0-root.io.2v0.58.0-root.io.2v0.58.0-root.io.3v0.58.0-root.io.4v0.56.0-root.io.1v0.41.0-root.io.2v0.40.0-root.io.2v0.38.0-root.io.4v0.47.0-root.io.3v0.35.0-root.io.4v0.54.0-root.io.2v0.59.0-root.io.3v0.38.0-root.io.5v0.40.0-root.io.3v0.35.0-root.io.5v0.41.0-root.io.3v0.56.0-root.io.2v0.47.0-root.io.4v0.49.0-root.io.1v0.52.0-root.io.4v0.58.0-root.io.5v0.29.0-root.io.4v0.38.0-root.io.6v0.56.0-root.io.3v0.41.0-root.io.4v0.40.0-root.io.4v0.47.0-root.io.5v0.54.0-root.io.3v0.52.0-root.io.5v0.57.0-root.io.4v0.29.0-root.io.5v0.54.0-root.io.4v0.55.0-root.io.6v0.23.0-root.io.3v0.29.0-root.io.6
go1.27
SUSE:Linux Enterprise Server 16.0
From an advisory covering 15 CVEs
 before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.27
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 15 CVEs
 before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.26
SUSE:Linux Enterprise Server 16.0
From an advisory covering 13 CVEs
 before 1.26.9-160000.1.1
1.26.9-160000.1.1
go1.26
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 13 CVEs
 before 1.26.9-160000.1.1
1.26.9-160000.1.1
google-guest-agent
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 20261022.00-159998.1.1
20261022.00-159998.1.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
 before 20261022.00-slfo.1.1_1.1
20261022.00-slfo.1.1_1.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.15-160000.5.1
3.15-160000.5.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.15-160000.5.1
3.15-160000.5.1
go1.27
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 15 CVEs
 before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.26
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 13 CVEs
 before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26-openssl
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 16 CVEs
 before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 16 CVEs
 before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 16 CVEs
 before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
golang-1.10
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~14.04.1
 None known
golang-1.10
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2
 None known
golang-1.6
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
 None known
golang-golang-x-net-dev
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
 None known
juju-core
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.24.6-0ubuntu31.25.0-0ubuntu11.25.0-0ubuntu21.25.0-0ubuntu32.0~beta4-0ubuntu2
Show 12 moreShow less
2.0~beta6-0ubuntu1.16.04.12.0~beta7-0ubuntu1.16.04.12.0~beta12-0ubuntu1.16.04.12.0~beta15-0ubuntu2.16.04.12.0.0-0ubuntu0.16.04.22.0.2-0ubuntu0.16.04.12.0.2-0ubuntu0.16.04.22.3.1-0ubuntu0.16.04.12.3.2-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.1+esm12.3.7-0ubuntu0.16.04.1+esm2
 None known
lxd
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.20-0ubuntu40.21-0ubuntu30.21-0ubuntu50.22-0ubuntu10.22-0ubuntu2
Show 45 moreShow less
0.23-0ubuntu10.23-0ubuntu20.23-0ubuntu30.24-0ubuntu20.24-0ubuntu30.24-0ubuntu40.25-0ubuntu10.26-0ubuntu20.26-0ubuntu30.27-0ubuntu10.27-0ubuntu22.0.0~beta1-0ubuntu32.0.0~beta1-0ubuntu42.0.0~beta2-0ubuntu12.0.0~beta2-0ubuntu22.0.0~beta3-0ubuntu12.0.0~beta3-0ubuntu22.0.0~beta3-0ubuntu32.0.0~beta3-0ubuntu42.0.0~beta4-0ubuntu12.0.0~beta4-0ubuntu22.0.0~beta4-0ubuntu32.0.0~beta4-0ubuntu42.0.0~beta4-0ubuntu52.0.0~beta4-0ubuntu62.0.0~beta4-0ubuntu72.0.0~rc1-0ubuntu12.0.0~rc1-0ubuntu22.0.0~rc1-0ubuntu32.0.0~rc2-0ubuntu22.0.0~rc2-0ubuntu32.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc3-0ubuntu42.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc6-0ubuntu12.0.0~rc6-0ubuntu22.0.0~rc7-0ubuntu12.0.0~rc7-0ubuntu22.0.0~rc8-0ubuntu12.0.0~rc8-0ubuntu22.0.0~rc8-0ubuntu32.0.0~rc8-0ubuntu5
 None known
containerd
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.2.1-0ubuntu4~16.040.2.3-0ubuntu1~16.040.2.5-0ubuntu1~16.04.11.2.6-0ubuntu1~16.04.21.2.6-0ubuntu1~16.04.3
Show 9 moreShow less
1.2.6-0ubuntu1~16.04.41.2.6-0ubuntu1~16.04.51.2.6-0ubuntu1~16.04.61.2.6-0ubuntu1~16.04.6+esm11.2.6-0ubuntu1~16.04.6+esm21.2.6-0ubuntu1~16.04.6+esm41.2.6-0ubuntu1~16.04.6+esm51.2.6-0ubuntu1~16.04.6+esm61.2.6-0ubuntu1~16.04.6+esm7
 None known
golang-1.13
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3
 None known
golang-1.18
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.18.1-1ubuntu1~16.04.61.18.1-1ubuntu1~16.04.6+esm1
 None known
google-guest-agent
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~16.04.020230426.00-0ubuntu2~16.04.320231004.02-0ubuntu1~16.04.120231004.02-0ubuntu1~16.04.220240716.00-0ubuntu1~16.04.020240716.00-0ubuntu1~16.04.0+esm120240716.00-0ubuntu1~16.04.0+esm220240716.00-0ubuntu1~16.04.0+esm3
 None known
google-osconfig-agent
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
20210219.00-0ubuntu1~16.04.020230504.00-0ubuntu1~16.04.020240320.00-0ubuntu1~16.04.020240524.03-0ubuntu2~16.04.020251028.00-0ubuntu2~16.04.1
 None known
golang-1.10
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2
 None known
lxd
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.18-0ubuntu62.19-0ubuntu12.20-0ubuntu32.20-0ubuntu42.21-0ubuntu1
Show 18 moreShow less
2.21-0ubuntu22.21-0ubuntu32.21-0ubuntu43.0.0~beta2-0ubuntu33.0.0~beta3-0ubuntu33.0.0~beta5-0ubuntu23.0.0~beta7-0ubuntu13.0.0-0ubuntu13.0.0-0ubuntu23.0.0-0ubuntu33.0.0-0ubuntu43.0.1-0ubuntu1~18.04.13.0.2-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.23.0.3-0ubuntu1~18.04.2+esm13.0.3-0ubuntu1~18.04.2+esm23.0.3-0ubuntu1~18.04.2+esm3
 None known
containerd
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
0.2.5-0ubuntu21.2.6-0ubuntu1~18.04.11.2.6-0ubuntu1~18.04.21.3.3-0ubuntu1~18.04.11.3.3-0ubuntu1~18.04.2
Show 15 moreShow less
1.3.3-0ubuntu1~18.04.31.3.3-0ubuntu1~18.04.41.4.4-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.11.5.2-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.31.5.5-0ubuntu3~18.04.11.5.5-0ubuntu3~18.04.21.5.9-0ubuntu1~18.04.11.5.9-0ubuntu1~18.04.21.6.12-0ubuntu1~18.04.11.6.12-0ubuntu1~18.04.1+esm11.6.12-0ubuntu1~18.04.1+esm21.6.12-0ubuntu1~18.04.1+esm31.6.12-0ubuntu1~18.04.1+esm4
 None known
golang-1.13
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1
 None known
golang-1.16
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.16.2-0ubuntu1~18.04.21.16.2-0ubuntu1~18.04.2+esm1
 None known
golang-1.18
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.18.1-1ubuntu1~18.04.31.18.1-1ubuntu1~18.04.41.18.1-1ubuntu1~18.04.4+esm1
 None known
golang-1.8
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
 None known
golang-1.9
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1
 None known
golang-golang-x-net-dev
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm11:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
 None known
google-guest-agent
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~18.04.020210414.00-0ubuntu1~18.04.020210629.00-0ubuntu1~18.04.120220622.00-0ubuntu2~18.04.020220622.00-0ubuntu2~18.04.1
Show 8 moreShow less
20230426.00-0ubuntu2~18.04.020231004.02-0ubuntu1~18.04.220231004.02-0ubuntu1~18.04.320240716.00-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.0+esm120241011.01-0ubuntu1~18.04.0+esm220241011.01-0ubuntu1~18.04.0+esm3
 None known
google-osconfig-agent
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
20210219.00-0ubuntu1~18.04.020210608.1-0ubuntu1~18.04.120210608.1-0ubuntu1~18.04.220220824.00-0ubuntu1~18.04.120230504.00-0ubuntu1~18.04.0
Show 4 moreShow less
20240320.00-0ubuntu1~18.04.020240524.03-0ubuntu2~18.04.020240926.03-0ubuntu1~18.04.020251028.00-0ubuntu2~18.04.0
 None known
adsys
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
0.8~22.040.9.2~20.040.9.2~20.04.10.9.2~20.04.20.9.2~20.04.2ubuntu0.10.9.2~20.04.2ubuntu0.1+esm10.9.2~20.04.2ubuntu0.1+esm2
 None known
containerd
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2.10-0ubuntu11.3.2-0ubuntu11.3.3-0ubuntu11.3.3-0ubuntu21.3.3-0ubuntu2.1
Show 20 moreShow less
1.3.3-0ubuntu2.21.3.3-0ubuntu2.31.4.4-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.11.5.2-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.31.5.5-0ubuntu3~20.04.11.5.5-0ubuntu3~20.04.21.5.9-0ubuntu1~20.04.11.5.9-0ubuntu1~20.04.41.5.9-0ubuntu1~20.04.51.5.9-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.11.6.12-0ubuntu1~20.04.31.6.12-0ubuntu1~20.04.51.6.12-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.71.6.12-0ubuntu1~20.04.81.6.12-0ubuntu1~20.04.8+esm11.6.12-0ubuntu1~20.04.8+esm2
 None known
golang-1.13
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu1
Show 5 moreShow less
1.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2
 None known
golang-1.14
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.14~beta1-11.14~beta1-21.14~rc1-11.14-11.14.1-1
Show 4 moreShow less
1.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.2
 None known
google-guest-agent
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~20.04.020210414.00-0ubuntu1~20.04.020210629.00-0ubuntu1~20.04.020220622.00-0ubuntu2~20.04.020220622.00-0ubuntu2~20.04.2
Show 11 moreShow less
20230426.00-0ubuntu2~20.04.020231004.02-0ubuntu1~20.04.120231004.02-0ubuntu1~20.04.220231004.02-0ubuntu1~20.04.320231004.02-0ubuntu1~20.04.420240716.00-0ubuntu1~20.04.020241011.01-0ubuntu1~20.04.120250116.00-0ubuntu1~20.04.020250116.00-0ubuntu1~20.04.0+esm120250116.00-0ubuntu1~20.04.0+esm220250116.00-0ubuntu1~20.04.0+esm3
 None known
golang-1.16
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.16.2-0ubuntu1~20.041.16.2-0ubuntu1~20.04.11.16.2-0ubuntu1~20.04.1+esm1
 None known
golang-1.18
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.18.1-1ubuntu1~20.04.11.18.1-1ubuntu1~20.04.21.18.1-1ubuntu1~20.04.3
 None known
golang-1.20
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu0.1~20.041.20.3-1ubuntu0.1~20.04.1
 None known
golang-1.21
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.21.1-1~ubuntu20.04.11.21.1-1~ubuntu20.04.21.21.1-1~ubuntu20.04.3
 None known
golang-golang-x-net-dev
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm21:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
 None known
google-osconfig-agent
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
20210219.00-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.120220824.00-0ubuntu1~20.04.120230504.00-0ubuntu1~20.04.0
Show 6 moreShow less
20240320.00-0ubuntu1~20.04.020240320.00-0ubuntu1~20.04.120240524.03-0ubuntu2~20.04.020240926.03-0ubuntu1~20.04.020250115.01-0ubuntu1~20.04.020251028.00-0ubuntu2~20.04.0
 None known
lxd
Ubuntu:20.04:LTS
 All versions, plus listed versions
1:0.71:0.81:0.91:0.10
 None known
adsys
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.7.10.7.1build10.80.8ubuntu10.8.1
Show 15 moreShow less
0.8.20.8.30.8.40.8.5~22.040.9.2~22.040.9.2~22.04.10.9.2~22.04.20.14.1~22.040.14.2~22.040.14.2~22.04ubuntu0.10.14.3~22.040.14.3~22.04ubuntu0.10.16.3~22.04.10.16.3~22.04.20.16.3~22.04.2ubuntu0.22.04.1
 None known
containerd
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.5.5-0ubuntu31.5.9-0ubuntu11.5.9-0ubuntu21.5.9-0ubuntu31.5.9-0ubuntu3.1
Show 9 moreShow less
1.6.12-0ubuntu1~22.04.11.6.12-0ubuntu1~22.04.31.6.12-0ubuntu1~22.04.51.6.12-0ubuntu1~22.04.61.6.12-0ubuntu1~22.04.71.6.12-0ubuntu1~22.04.81.6.12-0ubuntu1~22.04.91.6.12-0ubuntu1~22.04.101.6.12-0ubuntu1~22.04.11
 None known
golang-1.17
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.17-1ubuntu21.17.3-1ubuntu11.17.3-1ubuntu21.17.13-3ubuntu11.17.13-3ubuntu1.21.17.13-3ubuntu1.3
 None known
golang-1.18
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.18~beta1-0ubuntu11.18~beta2-1ubuntu11.18~beta2-1ubuntu21.18~rc1-1ubuntu11.18-1ubuntu1
Show 4 moreShow less
1.18.1-1ubuntu11.18.1-1ubuntu1.11.18.1-1ubuntu1.21.18.1-1ubuntu1.3
 None known
golang-1.20
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.20.3-1ubuntu0.1~22.041.20.3-1ubuntu0.1~22.04.1
 None known
golang-1.21
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.21.1-1~ubuntu22.04.11.21.1-1~ubuntu22.04.21.21.1-1~ubuntu22.04.31.21.1-1~ubuntu22.04.4
 None known
golang-1.22
Ubuntu:22.04:LTS
 before 1.22.2-2~22.04.4, plus listed versions
1.22.2-2~22.041.22.2-2~22.04.11.22.2-2~22.04.21.22.2-2~22.04.3
1.22.2-2~22.04.4
golang-1.23
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.23.1-1~22.041.23.1-1~22.04.21.23.1-1~22.04.3
 None known
golang-1.24
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu1~22.04.11.24.4-1ubuntu1~22.04.21.24.13-2~22.04.11.24.13-2~22.04.2
 None known
golang-1.25
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.25.14-1~ubuntu0.22.04.1
 None known
golang-1.26
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.26.8-1~ubuntu0.22.04.2
 None known
google-guest-agent
Ubuntu:22.04:LTS
 All versions, plus listed versions
20210629.00-0ubuntu120210629.00-0ubuntu220220104.00-0ubuntu120220104.00-0ubuntu220220622.00-0ubuntu2~22.04.0
Show 14 moreShow less
20220622.00-0ubuntu2~22.04.120230426.00-0ubuntu2~22.04.020231004.02-0ubuntu1~22.04.120231004.02-0ubuntu1~22.04.220231004.02-0ubuntu1~22.04.320231004.02-0ubuntu1~22.04.420231004.02-0ubuntu1~22.04.520240716.00-0ubuntu1~22.04.020241011.01-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.120250116.00-0ubuntu1~22.04.220250116.00-0ubuntu1~22.04.320250116.00-0ubuntu1~22.04.4
 None known
google-osconfig-agent
Ubuntu:22.04:LTS
 All versions, plus listed versions
20210608.1-0ubuntu120210608.1-0ubuntu220210608.1-0ubuntu320220824.00-0ubuntu1~22.04.120220824.00-0ubuntu1~22.04.2
Show 10 moreShow less
20230504.00-0ubuntu1~22.04.020230504.00-0ubuntu1~22.04.120240320.00-0ubuntu1~22.04.020240320.00-0ubuntu1~22.04.120240524.03-0ubuntu2~22.04.020240524.03-0ubuntu2~22.04.120240926.03-0ubuntu1~22.04.020250115.01-0ubuntu1~22.04.020251028.00-0ubuntu2~22.04.020251028.00-0ubuntu2~22.04.1
 None known
golang-1.13
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.1+esm11.13.8-1ubuntu2.22.04.2
 None known
golang-golang-x-net
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm21:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm31:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
 None known
adsys
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13.10.13.20.13.30.14.10.14.1build1
Show 8 moreShow less
0.14.1ubuntu0.24.04.10.14.2~24.040.14.2~24.04ubuntu0.10.14.3~24.040.14.3~24.04ubuntu0.10.16.3~24.04.10.16.3~24.04.20.16.3~24.04.2ubuntu0.24.04.1
 None known
golang-1.21
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.21.1-11.21.3-11.21.4-11.21.5-11.21.6-1
Show 6 moreShow less
1.21.7-11.21.7-21.21.8-11.21.8-1build11.21.9-11.21.9-1ubuntu0.1
 None known
golang-1.22
Ubuntu:24.04:LTS
 before 1.22.2-2ubuntu0.5, plus listed versions
1.22~rc1-21.22.0-11.22.0-21.22.1-11.22.1-1build1
Show 5 moreShow less
1.22.2-21.22.2-2ubuntu0.11.22.2-2ubuntu0.21.22.2-2ubuntu0.31.22.2-2ubuntu0.4
1.22.2-2ubuntu0.5
golang-1.23
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.23.1-1~24.041.23.1-1~24.04.1
 None known
golang-1.24
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu1~24.04.11.24.4-1ubuntu1~24.04.21.24.13-2~24.04.1
 None known
golang-1.25
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.25.14-1~ubuntu0.24.04.1
 None known
golang-1.26
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.26.8-1~ubuntu0.24.04.2
 None known
google-guest-agent
Ubuntu:24.04:LTS
 All versions, plus listed versions
20230426.00-0ubuntu320231004.02-0ubuntu120231004.02-0ubuntu320240213.00-0ubuntu120240213.00-0ubuntu2
Show 11 moreShow less
20240213.00-0ubuntu320240213.00-0ubuntu3.120240213.00-0ubuntu3.220240716.00-0ubuntu1~24.04.020240716.00-0ubuntu1~24.04.120241011.01-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.120250116.00-0ubuntu1~24.04.220250116.00-0ubuntu1~24.04.320250116.00-0ubuntu1~24.04.4
 None known
google-osconfig-agent
Ubuntu:24.04:LTS
 All versions, plus listed versions
20230504.00-0ubuntu220230504.00-0ubuntu320240320.00-0ubuntu1~24.04.020240320.00-0ubuntu1~24.04.120240320.00-0ubuntu1~24.04.2
Show 6 moreShow less
20240524.03-0ubuntu2~24.04.020240524.03-0ubuntu2~24.04.120240926.03-0ubuntu1~24.04.020250115.01-0ubuntu1~24.04.020250115.01-0ubuntu1~24.04.120251028.00-0ubuntu2~24.04.0
 None known
containerd
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.6.20~ds1-1ubuntu21.6.24~ds1-1ubuntu11.6.24~ds1-1ubuntu1.11.6.24~ds1-1ubuntu1.21.6.24~ds1-1ubuntu1.2+esm1
Show 4 moreShow less
1.6.24~ds1-1ubuntu1.31.6.24~ds1-1ubuntu1.3+esm11.6.24~ds1-1ubuntu1.3+esm21.6.24~ds1-1ubuntu1.3+esm3
 None known
golang-golang-x-net
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1:0.10.0-11:0.17.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.21.0+dfsg-1ubuntu0.1~esm11:0.21.0+dfsg-1ubuntu0.1~esm2
 None known
adsys
Ubuntu:26.10
 All versions, plus listed versions
0.16.4ubuntu10.16.4ubuntu20.17.0
 None known
containerd
Ubuntu:26.10
 All versions, plus listed versions
1.7.24~ds1-10ubuntu12.1.9+ds1-2ubuntu12.1.9+ds1-3ubuntu12.1.9+ds1-5ubuntu1
 None known
golang-1.26
Ubuntu:26.10
 All versions, plus listed versions
1.26.0-11.26.2-31.26.4-11.26.5-11.26.6-21.26.7-11.26.8-11.26.8-2
 None known
golang-1.27
Ubuntu:26.10
 All versions, plus listed versions
1.27~rc1-11.27~rc2-11.27~rc3-11.27.0-11.27.1-1
 None known
golang-golang-x-net
Ubuntu:26.10
 All versions, plus listed versions
1:0.27.0-21:0.57.0-11:0.58.0-1
 None known
google-guest-agent
Ubuntu:26.10
 All versions, plus listed versions
20250506.01-0ubuntu220250506.01-0ubuntu320260819.00+~20260819.00-0ubuntu1
 None known
google-osconfig-agent
Ubuntu:26.10
 All versions, plus listed versions
20251028.00-0ubuntu220251028.00-0ubuntu3
 None known
adsys
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.16.30.16.3ubuntu10.16.40.16.4ubuntu10.16.4ubuntu1.1
 None known
golang-1.23
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.23.10-1
 None known
golang-1.24
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.24.4-1ubuntu11.24.9-11.24.13-2
 None known
golang-1.25
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.25.0-0ubuntu11.25.7-21.25.14-1~ubuntu0.26.04.1
 None known
golang-1.26
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.26~rc3-21.26.0-11.26.8-1~ubuntu0.26.04.2
 None known
golang-golang-x-net
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:0.27.0-2
 None known
google-guest-agent
Ubuntu:26.04:LTS
 All versions, plus listed versions
20250506.01-0ubuntu120250506.01-0ubuntu220250506.01-0ubuntu2.1
 None known
google-osconfig-agent
Ubuntu:26.04:LTS
 All versions, plus listed versions
20250701.00-0ubuntu120251028.00-0ubuntu2
 None known
containerd
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.7.24~ds1-8ubuntu11.7.24~ds1-10ubuntu11.7.24~ds1-10ubuntu1+esm1
 None known
golang-1.22
Ubuntu:20.04:LTS
From an advisory covering 12 CVEs
 before 1.22.2-2~20.04.3, plus listed versions
1.22.2-2~20.04.11.22.2-2~20.04.2
1.22.2-2~20.04.3
golang-1.22
Ubuntu:22.04:LTS
From an advisory covering 12 CVEs
 before 1.22.2-2~22.04.4, plus listed versions
1.22.2-2~22.041.22.2-2~22.04.11.22.2-2~22.04.21.22.2-2~22.04.3
1.22.2-2~22.04.4
golang-1.22
Ubuntu:24.04:LTS
From an advisory covering 12 CVEs
 before 1.22.2-2ubuntu0.5, plus listed versions
1.22~rc1-21.22.0-11.22.0-21.22.1-11.22.1-1build1
Show 5 moreShow less
1.22.2-21.22.2-2ubuntu0.11.22.2-2ubuntu0.21.22.2-2ubuntu0.31.22.2-2ubuntu0.4
1.22.2-2ubuntu0.5
go1.26
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 1.26.9-1.1
1.26.9-1.1
go1.27
openSUSE:Tumbleweed
From an advisory covering 15 CVEs
 before 1.27.2-1.1
1.27.2-1.1
rclone
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 1.75.2-1.1
1.75.2-1.1
vexctl
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.4.4+git106.aa6ffc8-1.1
0.4.4+git106.aa6ffc8-1.1
containerized-data-importer1.65
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.65.0-4.1
1.65.0-4.1
kubevirt1.8
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 1.8.4-7.1
1.8.4-7.1
kubevirt1.9
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.9.1-2.1
1.9.1-2.1
git-bug
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 0.11.0-3.1
0.11.0-3.1
distribution
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.1.2-3.1
3.1.2-3.1
prometheus-ha_cluster_exporter
openSUSE:Tumbleweed
 before 1.4.3-1.1
1.4.3-1.1
timoni
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 0.36.0-1.1
0.36.0-1.1
fleet-cli
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.16.3-1.1
0.16.3-1.1
helm
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 4.3.1-3.1
4.3.1-3.1
alloy
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 1.21.3-1.1
1.21.3-1.1
go1.27
openSUSE:Leap 16.0
From an advisory covering 15 CVEs
 before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.26
openSUSE:Leap 16.0
From an advisory covering 13 CVEs
 before 1.26.9-160000.1.1
1.26.9-160000.1.1
kubevirt1.9
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 1.9.1-160000.1.1
1.9.1-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affectedOSV
affectedOSV
affected, aliases, facts, referencesOSV
affected, aliases, referencesOSV
aliases
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78660 is a high vulnerability (CVSS 7.5) in Go Standard Library Net/http, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in go 1.26.9-r0.

References

Show 142 moreShow less
This page doesn't list everything

Left out here: 26 versions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 43 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open