Every CVESearch/Get API key

CVE-2026-78659

HTTP/2 server memory exhaustion due to Trailer headers in net/http

7.5 HighFix available

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.87%Up 0.6 points since Oct 9, 2026
90%50%10%1%

What each source reports

CVE List Score used7.5

HTTP/2 server memory exhaustion due to Trailer headers in net/http

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
EUVDEUVD-2026-954197.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
EUVD-2026-95419
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD7.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
OSVALPINE-CVE-2026-786597.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
ALPINE-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-786597.5
Record
BELL-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-786597.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
DEBIAN-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 47 moreShow less
OSVOESA-2026-47689.1

golang security update

.

Security Fix(es):

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.(CVE-2026-94447)

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)

Record
OESA-2026-4768
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-11
OSVOESA-2026-47699.1

golang security update

.

Security Fix(es):

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.(CVE-2026-94447)

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)

Record
OESA-2026-4769
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-11
OSVOESA-2026-47709.1

golang security update

.

Security Fix(es):

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)

Record
OESA-2026-4770
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-11
OSVOESA-2026-47719.1

golang security update

.

Security Fix(es):

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.(CVE-2026-32280)

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.(CVE-2026-78659)

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.(CVE-2026-78663)

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.(CVE-2026-78669)

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.(CVE-2026-94439)

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.(CVE-2026-94447)

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.(CVE-2026-97032)

Record
OESA-2026-4771
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-11
OSVUBUNTU-CVE-2026-786597.5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
UBUNTU-CVE-2026-78659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:86093No score

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86093
Updated
2026-11-02
OSVALSA-2026:86196No score

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86196
Updated
2026-11-02
OSVALSA-2026:86203No score

Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
  • crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
  • net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
  • golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943)

Bug Fix(es) and Enhancement(s):

  • Update Go to version 1.26.10+1 [almalinux-8.10.z] (JIRA:AlmaLinux-287193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86203
Updated
2026-11-02
OSVAZL-107021No score

CVE-2026-78659 affecting package azl-otel-collector 0.127.0-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107021
Updated
2026-11-05
OSVAZL-107039No score

CVE-2026-78659 affecting package buildah 1.43.1-3

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107039
Updated
2026-11-05
OSVAZL-107069No score

CVE-2026-78659 affecting package cri-o 1.30.1-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107069
Updated
2026-11-05
OSVAZL-107087No score

CVE-2026-78659 affecting package kata-containers-preview 3.27.0~preview2-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107087
Updated
2026-11-05
OSVAZL-107114No score

CVE-2026-78659 affecting package podman 5.6.1-10

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107114
Updated
2026-11-05
OSVAZL-107135No score

CVE-2026-78659 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-7

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107135
Updated
2026-11-06
OSVAZL-107159No score

CVE-2026-78659 affecting package azcopy 10.25.1-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107159
Updated
2026-11-02
OSVAZL-107165No score

CVE-2026-78659 affecting package azurelinux-image-tools for versions less than 1.7.0-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107165
Updated
2026-11-05
OSVAZL-107180No score

CVE-2026-78659 affecting package cert-manager for versions less than 1.12.15-15

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107180
Updated
2026-11-05
OSVAZL-107210No score

CVE-2026-78659 affecting package cf-cli 8.7.11-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107210
Updated
2026-11-02
OSVAZL-107216No score

CVE-2026-78659 affecting package cloud-provider-kubevirt for versions less than 0.5.1-10

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107216
Updated
2026-11-05
OSVAZL-107240No score

CVE-2026-78659 affecting package containerd2 for versions less than 2.3.7-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107240
Updated
2026-11-05
OSVAZL-107255No score

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107255
Updated
2026-11-05
OSVAZL-107270No score

CVE-2026-78659 affecting package coredns for versions less than 1.11.4-23

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107270
Updated
2026-11-06
OSVAZL-107282No score

CVE-2026-78659 affecting package cri-tools 1.32.0-8

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107282
Updated
2026-11-02
OSVAZL-107306No score

CVE-2026-78659 affecting package docker-buildx for versions less than 0.14.0-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107306
Updated
2026-11-05
OSVAZL-107339No score

CVE-2026-78659 affecting package docker-cli 25.0.7-5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107339
Updated
2026-11-02
OSVAZL-107354No score

CVE-2026-78659 affecting package docker-compose for versions less than 2.27.0-16

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107354
Updated
2026-11-05
OSVAZL-107375No score

CVE-2026-78659 affecting package etcd for versions less than 3.5.35-1

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107375
Updated
2026-11-06
OSVAZL-107387No score

CVE-2026-78659 affecting package flannel for versions less than 0.24.2-34

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107387
Updated
2026-11-05
OSVAZL-107409No score

CVE-2026-78659 affecting package gh for versions less than 2.102.0-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107409
Updated
2026-11-05
OSVAZL-107430No score

CVE-2026-78659 affecting package git-lfs for versions less than 3.6.1-7

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107430
Updated
2026-11-06
OSVAZL-107514No score

CVE-2026-78659 affecting package ignition-flatcar for versions less than 2.22.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107514
Updated
2026-11-05
OSVAZL-107526No score

CVE-2026-78659 affecting package influxdb for versions less than 2.7.5-22

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107526
Updated
2026-11-05
OSVAZL-107544No score

CVE-2026-78659 affecting package jx for versions less than 3.10.182-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107544
Updated
2026-11-05
OSVAZL-107564No score

CVE-2026-78659 affecting package kata-containers for versions less than 4.1.0.kata1-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107564
Updated
2026-11-05
OSVAZL-107582No score

CVE-2026-78659 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107582
Updated
2026-11-05
OSVAZL-107601No score

CVE-2026-78659 affecting package keda 2.14.1-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107601
Updated
2026-11-02
OSVAZL-107619No score

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107619
Updated
2026-11-05
OSVAZL-107640No score

CVE-2026-78659 affecting package kubernetes for versions less than 1.30.10-32

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107640
Updated
2026-11-05
OSVAZL-107670No score

CVE-2026-78659 affecting package kubevirt for versions less than 1.8.4-4

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107670
Updated
2026-11-05
OSVAZL-107676No score

CVE-2026-78659 affecting package kured for versions less than 1.15.0-7

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107676
Updated
2026-11-05
OSVAZL-107694No score

CVE-2026-78659 affecting package libcontainers-common 20240213-3

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107694
Updated
2026-11-02
OSVAZL-107727No score

CVE-2026-78659 affecting package moby-containerd-cc for versions less than 1.7.7-19

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107727
Updated
2026-11-05
OSVAZL-107742No score

CVE-2026-78659 affecting package moby-engine 25.0.18-2

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107742
Updated
2026-11-13
OSVAZL-107766No score

CVE-2026-78659 affecting package multus for versions less than 4.0.2-12

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107766
Updated
2026-11-05
OSVAZL-107778No score

CVE-2026-78659 affecting package opa for versions less than 0.63.0-6

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107778
Updated
2026-11-06
OSVAZL-107790No score

CVE-2026-78659 affecting package packer for versions less than 1.9.5-23

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107790
Updated
2026-11-05
OSVAZL-107817No score

CVE-2026-78659 affecting package prometheus-adapter for versions less than 0.12.0-12

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Record
AZL-107817
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
docker
Alpine:v3.24
before 29.9.0-r0
29.9.0-r0
go
Alpine:v3.24
before 1.26.9-r0
1.26.9-r0
go-toolset
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-bin
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-docs
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-misc
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-race
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-src
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
golang-tests
AlmaLinux:10
From an advisory covering 15 CVEs
before 1.26.10-1.el10_2.alma.1
1.26.10-1.el10_2.alma.1
Show 236 moreShow less
Affected packages
PackageAffectedFixed
go-toolset
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-bin
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-docs
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-misc
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-race
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-src
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
golang-tests
AlmaLinux:9
From an advisory covering 15 CVEs
before 1.26.10-1.el9_8
1.26.10-1.el9_8
delve
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.1-1.module_el8.10.0+4307+6e4cbc60
1.26.1-1.module_el8.10.0+4307+6e4cbc60
go-toolset
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-bin
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-docs
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-misc
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-race
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-src
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
golang-tests
AlmaLinux:8
From an advisory covering 15 CVEs
before 1.26.10-1.module_el8.10.0+4307+6e4cbc60
1.26.10-1.module_el8.10.0+4307+6e4cbc60
azl-otel-collector
Azure Linux:3
through 0.127.0-1None known
buildah
Azure Linux:3
through 1.43.1-3None known
cri-o
Azure Linux:3
through 1.30.1-1None known
kata-containers-preview
Azure Linux:3
through 3.27.0~preview2-2None known
podman
Azure Linux:3
through 5.6.1-10None known
application-gateway-kubernetes-ingress
Azure Linux:3
before 1.7.7-7
1.7.7-7
azcopy
Azure Linux:3
through 10.25.1-9None known
azurelinux-image-tools
Azure Linux:3
before 1.7.0-2
1.7.0-2
cert-manager
Azure Linux:3
before 1.12.15-15
1.12.15-15
cf-cli
Azure Linux:3
through 8.7.11-9None known
cloud-provider-kubevirt
Azure Linux:3
before 0.5.1-10
0.5.1-10
containerd2
Azure Linux:3
before 2.3.7-1
2.3.7-1
containerized-data-importer
Azure Linux:3
before 1.62.0-9
1.62.0-9
coredns
Azure Linux:3
before 1.11.4-23
1.11.4-23
cri-tools
Azure Linux:3
through 1.32.0-8None known
docker-buildx
Azure Linux:3
before 0.14.0-19
0.14.0-19
docker-cli
Azure Linux:3
through 25.0.7-5None known
docker-compose
Azure Linux:3
before 2.27.0-16
2.27.0-16
etcd
Azure Linux:3
before 3.5.35-1
3.5.35-1
flannel
Azure Linux:3
before 0.24.2-34
0.24.2-34
gh
Azure Linux:3
before 2.102.0-2
2.102.0-2
git-lfs
Azure Linux:3
before 3.6.1-7
3.6.1-7
ignition-flatcar
Azure Linux:3
before 2.22.0-6
2.22.0-6
influxdb
Azure Linux:3
before 2.7.5-22
2.7.5-22
jx
Azure Linux:3
before 3.10.182-6
3.10.182-6
kata-containers
Azure Linux:3
before 4.1.0.kata1-2
4.1.0.kata1-2
kata-containers-cc
Azure Linux:3
before 3.15.0.aks0-23
3.15.0.aks0-23
keda
Azure Linux:3
through 2.14.1-19None known
kube-vip-cloud-provider
Azure Linux:3
before 0.0.10-11
0.0.10-11
kubernetes
Azure Linux:3
before 1.30.10-32
1.30.10-32
kubevirt
Azure Linux:3
before 1.8.4-4
1.8.4-4
kured
Azure Linux:3
before 1.15.0-7
1.15.0-7
libcontainers-common
Azure Linux:3
through 20240213-3None known
moby-containerd-cc
Azure Linux:3
before 1.7.7-19
1.7.7-19
moby-engine
Azure Linux:3
through 25.0.18-2None known
multus
Azure Linux:3
before 4.0.2-12
4.0.2-12
opa
Azure Linux:3
before 0.63.0-6
0.63.0-6
packer
Azure Linux:3
before 1.9.5-23
1.9.5-23
prometheus-adapter
Azure Linux:3
before 0.12.0-12
0.12.0-12
prometheus-node-exporter
Azure Linux:3
before 1.7.0-6
1.7.0-6
prometheus-process-exporter
Azure Linux:3
before 0.8.2-6
0.8.2-6
skopeo
Azure Linux:3
before 1.14.4-15
1.14.4-15
sriov-network-device-plugin
Azure Linux:3
through 3.7.0-8None known
telegraf
Azure Linux:3
before 1.31.0-35
1.31.0-35
vitess
Azure Linux:3
before 19.0.4-16
19.0.4-16
golang
Azure Linux:3
through 1.26.11-1None known
golang
Azure Linux:3
1.27.0 to 1.27.4-1None known
gcc
Azure Linux:3
through 13.2.0-7None known
python-tensorboard
Azure Linux:3
through 2.16.2-6None known
tensorflow
Azure Linux:3
through 2.16.1-11None known
kubevirt-openvmm
Azure Linux:3
through 1.9.0-1None known
go
Alpaquita:23
1.19.7-r0 up to 1.26.9-r0
1.26.9-r0
go
Alpaquita:25
1.24.3-r0 up to 1.26.9-r0
1.26.9-r0
docker
Alpaquita:stream
24.0.2-r0 up to 29.9.0-r0
29.9.0-r0
go
Alpaquita:stream
1.20.5-r2 up to 1.27.2-r0
1.27.2-r0
go
BellSoft Hardened Containers:23
1.19.7-r0 up to 1.26.9-r0
1.26.9-r0
go
BellSoft Hardened Containers:25
1.24.3-r0 up to 1.26.9-r0
1.26.9-r0
go
BellSoft Hardened Containers:stream
1.20.5-r2 up to 1.27.2-r0
1.27.2-r0
golang
Bitnami
before 1.26.9, 1.27.0-0 up to 1.27.2
1.26.91.27.2
golang-1.19
Debian:12
All versions, plus listed versions
1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2
Show 7 moreShow less
1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1
None known
golang-1.24
Debian:13
All versions, plus listed versions
1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2
Show 5 moreShow less
1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1
None known
golang-1.26
Debian:14
before 1.26.9-1, plus listed versions
1.26.0-11.26.1-11.26.2-11.26.2-21.26.2-3
Show 18 moreShow less
1.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26~rc2-11.26~rc3-11.26~rc3-2
1.26.9-1
golang-1.27
Debian:14
before 1.27.2-1, plus listed versions
1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1
Show 4 moreShow less
1.27.2-1~bpo13+11.27~rc1-11.27~rc2-11.27~rc3-1
1.27.2-1
golang-golang-x-net
Debian:12
All versions, plus listed versions
1:0.10.0-11:0.11.0-11:0.14.0-11:0.15.0-11:0.15.0-2
Show 23 moreShow less
1:0.17.0+dfsg-11:0.19.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.22.0+dfsg-11:0.23.0+dfsg-11:0.24.0+dfsg-11:0.25.0+dfsg-11:0.26.0+dfsg-11:0.26.0+dfsg-21:0.27.0-11:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-21:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-11:0.7.0+dfsg-1
None known
golang-golang-x-net
Debian:13
All versions, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 6 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-11:0.60.0-1
None known
golang-golang-x-net
Debian:14
before 1:0.60.0-1, plus listed versions
1:0.27.0-21:0.47.0-11:0.47.0-21:0.53.0-11:0.53.0-2
Show 5 moreShow less
1:0.53.0-2~bpo13+11:0.55.0-11:0.56.0-11:0.57.0-11:0.58.0-1
1:0.60.0-1
stdlib
Go
before 1.26.9
1.26.9
stdlib
Go
1.27.0-0 up to 1.27.2
1.27.2
golang.org/x/net
Go
before 0.60.0
0.60.0
golang
Mageia:10
From an advisory covering 14 CVEs
before 1.26.9-1.mga10
1.26.9-1.mga10
rclone
Mageia:10
From an advisory covering 41 CVEs
before 1.75.2-2.mga10
1.75.2-2.mga10
golang
openEuler:24.03-LTS-SP3
From an advisory covering 7 CVEs
before 1.21.4-53.oe2403sp3
1.21.4-53.oe2403sp3
golang
openEuler:24.03-LTS-SP4
From an advisory covering 7 CVEs
before 1.21.4-55.oe2403sp4
1.21.4-55.oe2403sp4
golang
openEuler:22.03-LTS-SP4
From an advisory covering 6 CVEs
before 1.17.3-53.oe2203sp4
1.17.3-53.oe2203sp4
golang
openEuler:24.03-LTS-SP1
From an advisory covering 7 CVEs
before 1.21.4-50.oe2403sp1
1.21.4-50.oe2403sp1
go1.27
SUSE:Linux Enterprise Server 16.0
From an advisory covering 15 CVEs
before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.27
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 15 CVEs
before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.26
SUSE:Linux Enterprise Server 16.0
From an advisory covering 13 CVEs
before 1.26.9-160000.1.1
1.26.9-160000.1.1
go1.26
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 13 CVEs
before 1.26.9-160000.1.1
1.26.9-160000.1.1
google-guest-agent
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
before 20261022.00-159998.1.1
20261022.00-159998.1.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
before 20261022.00-slfo.1.1_1.1
20261022.00-slfo.1.1_1.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
before 3.15-160000.5.1
3.15-160000.5.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
before 3.15-160000.5.1
3.15-160000.5.1
go1.27
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.27
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 15 CVEs
before 1.27.2-150000.1.12.1
1.27.2-150000.1.12.1
go1.26
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 13 CVEs
before 1.26.9-150000.1.33.1
1.26.9-150000.1.33.1
go1.26-openssl
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 16 CVEs
before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 16 CVEs
before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 16 CVEs
before 1.26.10-150600.13.18.1
1.26.10-150600.13.18.1
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
go1.26-openssl
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 16 CVEs
before 1.26.10-150000.1.21.2
1.26.10-150000.1.21.2
kubevirt
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 11 CVEs
before 1.7.4-150700.3.42.1
1.7.4-150700.3.42.1
golang-1.10
Ubuntu:14.04:LTS
All versions, plus listed versions
1.10.4-2ubuntu1~14.04.1
None known
golang-1.10
Ubuntu:16.04:LTS
All versions, plus listed versions
1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2
None known
golang-1.6
Ubuntu:16.04:LTS
All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
None known
golang-golang-x-net-dev
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
0.0+git20150226.3d87fd6-30.0+git20151007.b846920+dfsg-11:0.0+git20150817.66f0418-11:0.0+git20160110.4fd4a9f-11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm11:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm2
None known
juju-core
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1.24.6-0ubuntu31.25.0-0ubuntu11.25.0-0ubuntu21.25.0-0ubuntu32.0~beta4-0ubuntu2
Show 12 moreShow less
2.0~beta6-0ubuntu1.16.04.12.0~beta7-0ubuntu1.16.04.12.0~beta12-0ubuntu1.16.04.12.0~beta15-0ubuntu2.16.04.12.0.0-0ubuntu0.16.04.22.0.2-0ubuntu0.16.04.12.0.2-0ubuntu0.16.04.22.3.1-0ubuntu0.16.04.12.3.2-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.12.3.7-0ubuntu0.16.04.1+esm12.3.7-0ubuntu0.16.04.1+esm2
None known
lxd
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
0.20-0ubuntu40.21-0ubuntu30.21-0ubuntu50.22-0ubuntu10.22-0ubuntu2
Show 45 moreShow less
0.23-0ubuntu10.23-0ubuntu20.23-0ubuntu30.24-0ubuntu20.24-0ubuntu30.24-0ubuntu40.25-0ubuntu10.26-0ubuntu20.26-0ubuntu30.27-0ubuntu10.27-0ubuntu22.0.0~beta1-0ubuntu32.0.0~beta1-0ubuntu42.0.0~beta2-0ubuntu12.0.0~beta2-0ubuntu22.0.0~beta3-0ubuntu12.0.0~beta3-0ubuntu22.0.0~beta3-0ubuntu32.0.0~beta3-0ubuntu42.0.0~beta4-0ubuntu12.0.0~beta4-0ubuntu22.0.0~beta4-0ubuntu32.0.0~beta4-0ubuntu42.0.0~beta4-0ubuntu52.0.0~beta4-0ubuntu62.0.0~beta4-0ubuntu72.0.0~rc1-0ubuntu12.0.0~rc1-0ubuntu22.0.0~rc1-0ubuntu32.0.0~rc2-0ubuntu22.0.0~rc2-0ubuntu32.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc3-0ubuntu42.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc6-0ubuntu12.0.0~rc6-0ubuntu22.0.0~rc7-0ubuntu12.0.0~rc7-0ubuntu22.0.0~rc8-0ubuntu12.0.0~rc8-0ubuntu22.0.0~rc8-0ubuntu32.0.0~rc8-0ubuntu5
None known
containerd
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
0.2.1-0ubuntu4~16.040.2.3-0ubuntu1~16.040.2.5-0ubuntu1~16.04.11.2.6-0ubuntu1~16.04.21.2.6-0ubuntu1~16.04.3
Show 9 moreShow less
1.2.6-0ubuntu1~16.04.41.2.6-0ubuntu1~16.04.51.2.6-0ubuntu1~16.04.61.2.6-0ubuntu1~16.04.6+esm11.2.6-0ubuntu1~16.04.6+esm21.2.6-0ubuntu1~16.04.6+esm41.2.6-0ubuntu1~16.04.6+esm51.2.6-0ubuntu1~16.04.6+esm61.2.6-0ubuntu1~16.04.6+esm7
None known
golang-1.13
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3
None known
golang-1.18
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1.18.1-1ubuntu1~16.04.61.18.1-1ubuntu1~16.04.6+esm1
None known
google-guest-agent
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
20201217.02-0ubuntu1~16.04.020230426.00-0ubuntu2~16.04.320231004.02-0ubuntu1~16.04.120231004.02-0ubuntu1~16.04.220240716.00-0ubuntu1~16.04.020240716.00-0ubuntu1~16.04.0+esm120240716.00-0ubuntu1~16.04.0+esm220240716.00-0ubuntu1~16.04.0+esm3
None known
google-osconfig-agent
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
20210219.00-0ubuntu1~16.04.020230504.00-0ubuntu1~16.04.020240320.00-0ubuntu1~16.04.020240524.03-0ubuntu2~16.04.020251028.00-0ubuntu2~16.04.1
None known
golang-1.10
Ubuntu:18.04:LTS
All versions, plus listed versions
1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2
None known
lxd
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
2.18-0ubuntu62.19-0ubuntu12.20-0ubuntu32.20-0ubuntu42.21-0ubuntu1
Show 18 moreShow less
2.21-0ubuntu22.21-0ubuntu32.21-0ubuntu43.0.0~beta2-0ubuntu33.0.0~beta3-0ubuntu33.0.0~beta5-0ubuntu23.0.0~beta7-0ubuntu13.0.0-0ubuntu13.0.0-0ubuntu23.0.0-0ubuntu33.0.0-0ubuntu43.0.1-0ubuntu1~18.04.13.0.2-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.23.0.3-0ubuntu1~18.04.2+esm13.0.3-0ubuntu1~18.04.2+esm23.0.3-0ubuntu1~18.04.2+esm3
None known
containerd
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
0.2.5-0ubuntu21.2.6-0ubuntu1~18.04.11.2.6-0ubuntu1~18.04.21.3.3-0ubuntu1~18.04.11.3.3-0ubuntu1~18.04.2
Show 15 moreShow less
1.3.3-0ubuntu1~18.04.31.3.3-0ubuntu1~18.04.41.4.4-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.11.5.2-0ubuntu1~18.04.21.5.2-0ubuntu1~18.04.31.5.5-0ubuntu3~18.04.11.5.5-0ubuntu3~18.04.21.5.9-0ubuntu1~18.04.11.5.9-0ubuntu1~18.04.21.6.12-0ubuntu1~18.04.11.6.12-0ubuntu1~18.04.1+esm11.6.12-0ubuntu1~18.04.1+esm21.6.12-0ubuntu1~18.04.1+esm31.6.12-0ubuntu1~18.04.1+esm4
None known
golang-1.13
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1
None known
golang-1.16
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1.16.2-0ubuntu1~18.04.21.16.2-0ubuntu1~18.04.2+esm1
None known
golang-1.18
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1.18.1-1ubuntu1~18.04.31.18.1-1ubuntu1~18.04.41.18.1-1ubuntu1~18.04.4+esm1
None known
golang-1.8
Ubuntu:18.04:LTS
All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
None known
golang-1.9
Ubuntu:18.04:LTS
All versions, plus listed versions
1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1
None known
golang-golang-x-net-dev
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1:0.0+git20170629.c81e7f2+dfsg-1ubuntu11:0.0+git20170629.c81e7f2+dfsg-1ubuntu21:0.0+git20170629.c81e7f2+dfsg-21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm11:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm21:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm3
None known
google-guest-agent
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
20201217.02-0ubuntu1~18.04.020210414.00-0ubuntu1~18.04.020210629.00-0ubuntu1~18.04.120220622.00-0ubuntu2~18.04.020220622.00-0ubuntu2~18.04.1
Show 8 moreShow less
20230426.00-0ubuntu2~18.04.020231004.02-0ubuntu1~18.04.220231004.02-0ubuntu1~18.04.320240716.00-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.0+esm120241011.01-0ubuntu1~18.04.0+esm220241011.01-0ubuntu1~18.04.0+esm3
None known
google-osconfig-agent
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
20210219.00-0ubuntu1~18.04.020210608.1-0ubuntu1~18.04.120210608.1-0ubuntu1~18.04.220220824.00-0ubuntu1~18.04.120230504.00-0ubuntu1~18.04.0
Show 4 moreShow less
20240320.00-0ubuntu1~18.04.020240524.03-0ubuntu2~18.04.020240926.03-0ubuntu1~18.04.020251028.00-0ubuntu2~18.04.0
None known
adsys
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
0.8~22.040.9.2~20.040.9.2~20.04.10.9.2~20.04.20.9.2~20.04.2ubuntu0.10.9.2~20.04.2ubuntu0.1+esm10.9.2~20.04.2ubuntu0.1+esm2
None known
containerd
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
1.2.10-0ubuntu11.3.2-0ubuntu11.3.3-0ubuntu11.3.3-0ubuntu21.3.3-0ubuntu2.1
Show 20 moreShow less
1.3.3-0ubuntu2.21.3.3-0ubuntu2.31.4.4-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.11.5.2-0ubuntu1~20.04.21.5.2-0ubuntu1~20.04.31.5.5-0ubuntu3~20.04.11.5.5-0ubuntu3~20.04.21.5.9-0ubuntu1~20.04.11.5.9-0ubuntu1~20.04.41.5.9-0ubuntu1~20.04.51.5.9-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.11.6.12-0ubuntu1~20.04.31.6.12-0ubuntu1~20.04.51.6.12-0ubuntu1~20.04.61.6.12-0ubuntu1~20.04.71.6.12-0ubuntu1~20.04.81.6.12-0ubuntu1~20.04.8+esm11.6.12-0ubuntu1~20.04.8+esm2
None known
golang-1.13
Ubuntu:20.04:LTS
All versions, plus listed versions
1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu1
Show 5 moreShow less
1.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2
None known
golang-1.14
Ubuntu:20.04:LTS
All versions, plus listed versions
1.14~beta1-11.14~beta1-21.14~rc1-11.14-11.14.1-1
Show 4 moreShow less
1.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.2
None known
google-guest-agent
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
20201217.02-0ubuntu1~20.04.020210414.00-0ubuntu1~20.04.020210629.00-0ubuntu1~20.04.020220622.00-0ubuntu2~20.04.020220622.00-0ubuntu2~20.04.2
Show 11 moreShow less
20230426.00-0ubuntu2~20.04.020231004.02-0ubuntu1~20.04.120231004.02-0ubuntu1~20.04.220231004.02-0ubuntu1~20.04.320231004.02-0ubuntu1~20.04.420240716.00-0ubuntu1~20.04.020241011.01-0ubuntu1~20.04.120250116.00-0ubuntu1~20.04.020250116.00-0ubuntu1~20.04.0+esm120250116.00-0ubuntu1~20.04.0+esm220250116.00-0ubuntu1~20.04.0+esm3
None known
golang-1.16
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
1.16.2-0ubuntu1~20.041.16.2-0ubuntu1~20.04.11.16.2-0ubuntu1~20.04.1+esm1
None known
golang-1.18
Ubuntu:20.04:LTS
All versions, plus listed versions
1.18.1-1ubuntu1~20.04.11.18.1-1ubuntu1~20.04.21.18.1-1ubuntu1~20.04.3
None known
golang-1.20
Ubuntu:20.04:LTS
All versions, plus listed versions
1.20.3-1ubuntu0.1~20.041.20.3-1ubuntu0.1~20.04.1
None known
golang-1.21
Ubuntu:20.04:LTS
All versions, plus listed versions
1.21.1-1~ubuntu20.04.11.21.1-1~ubuntu20.04.21.21.1-1~ubuntu20.04.3
None known
golang-golang-x-net-dev
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
1:0.0+git20190811.74dc4d7+dfsg-11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm11:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm21:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm3
None known
google-osconfig-agent
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
20210219.00-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.020210608.1-0ubuntu1~20.04.120220824.00-0ubuntu1~20.04.120230504.00-0ubuntu1~20.04.0
Show 6 moreShow less
20240320.00-0ubuntu1~20.04.020240320.00-0ubuntu1~20.04.120240524.03-0ubuntu2~20.04.020240926.03-0ubuntu1~20.04.020250115.01-0ubuntu1~20.04.020251028.00-0ubuntu2~20.04.0
None known
lxd
Ubuntu:20.04:LTS
All versions, plus listed versions
1:0.71:0.81:0.91:0.10
None known
adsys
Ubuntu:22.04:LTS
All versions, plus listed versions
0.7.10.7.1build10.80.8ubuntu10.8.1
Show 15 moreShow less
0.8.20.8.30.8.40.8.5~22.040.9.2~22.040.9.2~22.04.10.9.2~22.04.20.14.1~22.040.14.2~22.040.14.2~22.04ubuntu0.10.14.3~22.040.14.3~22.04ubuntu0.10.16.3~22.04.10.16.3~22.04.20.16.3~22.04.2ubuntu0.22.04.1
None known
containerd
Ubuntu:22.04:LTS
All versions, plus listed versions
1.5.5-0ubuntu31.5.9-0ubuntu11.5.9-0ubuntu21.5.9-0ubuntu31.5.9-0ubuntu3.1
Show 9 moreShow less
1.6.12-0ubuntu1~22.04.11.6.12-0ubuntu1~22.04.31.6.12-0ubuntu1~22.04.51.6.12-0ubuntu1~22.04.61.6.12-0ubuntu1~22.04.71.6.12-0ubuntu1~22.04.81.6.12-0ubuntu1~22.04.91.6.12-0ubuntu1~22.04.101.6.12-0ubuntu1~22.04.11
None known
golang-1.17
Ubuntu:22.04:LTS
All versions, plus listed versions
1.17-1ubuntu21.17.3-1ubuntu11.17.3-1ubuntu21.17.13-3ubuntu11.17.13-3ubuntu1.21.17.13-3ubuntu1.3
None known
golang-1.18
Ubuntu:22.04:LTS
All versions, plus listed versions
1.18~beta1-0ubuntu11.18~beta2-1ubuntu11.18~beta2-1ubuntu21.18~rc1-1ubuntu11.18-1ubuntu1
Show 4 moreShow less
1.18.1-1ubuntu11.18.1-1ubuntu1.11.18.1-1ubuntu1.21.18.1-1ubuntu1.3
None known
golang-1.20
Ubuntu:22.04:LTS
All versions, plus listed versions
1.20.3-1ubuntu0.1~22.041.20.3-1ubuntu0.1~22.04.1
None known
golang-1.21
Ubuntu:22.04:LTS
All versions, plus listed versions
1.21.1-1~ubuntu22.04.11.21.1-1~ubuntu22.04.21.21.1-1~ubuntu22.04.31.21.1-1~ubuntu22.04.4
None known
golang-1.22
Ubuntu:22.04:LTS
before 1.22.2-2~22.04.4, plus listed versions
1.22.2-2~22.041.22.2-2~22.04.11.22.2-2~22.04.21.22.2-2~22.04.3
1.22.2-2~22.04.4
golang-1.23
Ubuntu:22.04:LTS
All versions, plus listed versions
1.23.1-1~22.041.23.1-1~22.04.21.23.1-1~22.04.3
None known
golang-1.24
Ubuntu:22.04:LTS
All versions, plus listed versions
1.24.4-1ubuntu1~22.04.11.24.4-1ubuntu1~22.04.21.24.13-2~22.04.11.24.13-2~22.04.2
None known
golang-1.25
Ubuntu:22.04:LTS
All versions, plus listed versions
1.25.14-1~ubuntu0.22.04.1
None known
golang-1.26
Ubuntu:22.04:LTS
All versions, plus listed versions
1.26.8-1~ubuntu0.22.04.2
None known
google-guest-agent
Ubuntu:22.04:LTS
All versions, plus listed versions
20210629.00-0ubuntu120210629.00-0ubuntu220220104.00-0ubuntu120220104.00-0ubuntu220220622.00-0ubuntu2~22.04.0
Show 14 moreShow less
20220622.00-0ubuntu2~22.04.120230426.00-0ubuntu2~22.04.020231004.02-0ubuntu1~22.04.120231004.02-0ubuntu1~22.04.220231004.02-0ubuntu1~22.04.320231004.02-0ubuntu1~22.04.420231004.02-0ubuntu1~22.04.520240716.00-0ubuntu1~22.04.020241011.01-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.120250116.00-0ubuntu1~22.04.220250116.00-0ubuntu1~22.04.320250116.00-0ubuntu1~22.04.4
None known
google-osconfig-agent
Ubuntu:22.04:LTS
All versions, plus listed versions
20210608.1-0ubuntu120210608.1-0ubuntu220210608.1-0ubuntu320220824.00-0ubuntu1~22.04.120220824.00-0ubuntu1~22.04.2
Show 10 moreShow less
20230504.00-0ubuntu1~22.04.020230504.00-0ubuntu1~22.04.120240320.00-0ubuntu1~22.04.020240320.00-0ubuntu1~22.04.120240524.03-0ubuntu2~22.04.020240524.03-0ubuntu2~22.04.120240926.03-0ubuntu1~22.04.020250115.01-0ubuntu1~22.04.020251028.00-0ubuntu2~22.04.020251028.00-0ubuntu2~22.04.1
None known
golang-1.13
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.1+esm11.13.8-1ubuntu2.22.04.2
None known
golang-golang-x-net
Ubuntu:22.04:LTS
All versions, plus listed versions
1:0.0+git20210119.5f4716e+dfsg-41:0.0+git20210805.aaa1db6+dfsg-11:0.0+git20211209.491a49a+dfsg-11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm11:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm21:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm31:0.0+git20211209.491a49a+dfsg-1ubuntu0.1
None known
adsys
Ubuntu:24.04:LTS
All versions, plus listed versions
0.13.10.13.20.13.30.14.10.14.1build1
Show 8 moreShow less
0.14.1ubuntu0.24.04.10.14.2~24.040.14.2~24.04ubuntu0.10.14.3~24.040.14.3~24.04ubuntu0.10.16.3~24.04.10.16.3~24.04.20.16.3~24.04.2ubuntu0.24.04.1
None known
golang-1.21
Ubuntu:24.04:LTS
All versions, plus listed versions
1.21.1-11.21.3-11.21.4-11.21.5-11.21.6-1
Show 6 moreShow less
1.21.7-11.21.7-21.21.8-11.21.8-1build11.21.9-11.21.9-1ubuntu0.1
None known
golang-1.22
Ubuntu:24.04:LTS
before 1.22.2-2ubuntu0.5, plus listed versions
1.22~rc1-21.22.0-11.22.0-21.22.1-11.22.1-1build1
Show 5 moreShow less
1.22.2-21.22.2-2ubuntu0.11.22.2-2ubuntu0.21.22.2-2ubuntu0.31.22.2-2ubuntu0.4
1.22.2-2ubuntu0.5
golang-1.23
Ubuntu:24.04:LTS
All versions, plus listed versions
1.23.1-1~24.041.23.1-1~24.04.1
None known
golang-1.24
Ubuntu:24.04:LTS
All versions, plus listed versions
1.24.4-1ubuntu1~24.04.11.24.4-1ubuntu1~24.04.21.24.13-2~24.04.1
None known
golang-1.25
Ubuntu:24.04:LTS
All versions, plus listed versions
1.25.14-1~ubuntu0.24.04.1
None known
golang-1.26
Ubuntu:24.04:LTS
All versions, plus listed versions
1.26.8-1~ubuntu0.24.04.2
None known
google-guest-agent
Ubuntu:24.04:LTS
All versions, plus listed versions
20230426.00-0ubuntu320231004.02-0ubuntu120231004.02-0ubuntu320240213.00-0ubuntu120240213.00-0ubuntu2
Show 11 moreShow less
20240213.00-0ubuntu320240213.00-0ubuntu3.120240213.00-0ubuntu3.220240716.00-0ubuntu1~24.04.020240716.00-0ubuntu1~24.04.120241011.01-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.120250116.00-0ubuntu1~24.04.220250116.00-0ubuntu1~24.04.320250116.00-0ubuntu1~24.04.4
None known
google-osconfig-agent
Ubuntu:24.04:LTS
All versions, plus listed versions
20230504.00-0ubuntu220230504.00-0ubuntu320240320.00-0ubuntu1~24.04.020240320.00-0ubuntu1~24.04.120240320.00-0ubuntu1~24.04.2
Show 6 moreShow less
20240524.03-0ubuntu2~24.04.020240524.03-0ubuntu2~24.04.120240926.03-0ubuntu1~24.04.020250115.01-0ubuntu1~24.04.020250115.01-0ubuntu1~24.04.120251028.00-0ubuntu2~24.04.0
None known
containerd
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
1.6.20~ds1-1ubuntu21.6.24~ds1-1ubuntu11.6.24~ds1-1ubuntu1.11.6.24~ds1-1ubuntu1.21.6.24~ds1-1ubuntu1.2+esm1
Show 4 moreShow less
1.6.24~ds1-1ubuntu1.31.6.24~ds1-1ubuntu1.3+esm11.6.24~ds1-1ubuntu1.3+esm21.6.24~ds1-1ubuntu1.3+esm3
None known
golang-golang-x-net
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
1:0.10.0-11:0.17.0+dfsg-11:0.20.0+dfsg-11:0.21.0+dfsg-11:0.21.0+dfsg-1ubuntu0.1~esm11:0.21.0+dfsg-1ubuntu0.1~esm2
None known
adsys
Ubuntu:26.10
All versions, plus listed versions
0.16.4ubuntu10.16.4ubuntu20.17.0
None known
containerd
Ubuntu:26.10
All versions, plus listed versions
1.7.24~ds1-10ubuntu12.1.9+ds1-2ubuntu12.1.9+ds1-3ubuntu12.1.9+ds1-5ubuntu1
None known
golang-1.26
Ubuntu:26.10
All versions, plus listed versions
1.26.0-11.26.2-31.26.4-11.26.5-11.26.6-21.26.7-11.26.8-11.26.8-2
None known
golang-1.27
Ubuntu:26.10
All versions, plus listed versions
1.27~rc1-11.27~rc2-11.27~rc3-11.27.0-11.27.1-1
None known
golang-golang-x-net
Ubuntu:26.10
All versions, plus listed versions
1:0.27.0-21:0.57.0-11:0.58.0-1
None known
google-guest-agent
Ubuntu:26.10
All versions, plus listed versions
20250506.01-0ubuntu220250506.01-0ubuntu320260819.00+~20260819.00-0ubuntu1
None known
google-osconfig-agent
Ubuntu:26.10
All versions, plus listed versions
20251028.00-0ubuntu220251028.00-0ubuntu3
None known
adsys
Ubuntu:26.04:LTS
All versions, plus listed versions
0.16.30.16.3ubuntu10.16.40.16.4ubuntu10.16.4ubuntu1.1
None known
golang-1.23
Ubuntu:26.04:LTS
All versions, plus listed versions
1.23.10-1
None known
golang-1.24
Ubuntu:26.04:LTS
All versions, plus listed versions
1.24.4-1ubuntu11.24.9-11.24.13-2
None known
golang-1.25
Ubuntu:26.04:LTS
All versions, plus listed versions
1.25.0-0ubuntu11.25.7-21.25.14-1~ubuntu0.26.04.1
None known
golang-1.26
Ubuntu:26.04:LTS
All versions, plus listed versions
1.26~rc3-21.26.0-11.26.8-1~ubuntu0.26.04.2
None known
golang-golang-x-net
Ubuntu:26.04:LTS
All versions, plus listed versions
1:0.27.0-2
None known
google-guest-agent
Ubuntu:26.04:LTS
All versions, plus listed versions
20250506.01-0ubuntu120250506.01-0ubuntu220250506.01-0ubuntu2.1
None known
google-osconfig-agent
Ubuntu:26.04:LTS
All versions, plus listed versions
20250701.00-0ubuntu120251028.00-0ubuntu2
None known
containerd
Ubuntu:Pro:26.04:LTS
All versions, plus listed versions
1.7.24~ds1-8ubuntu11.7.24~ds1-10ubuntu11.7.24~ds1-10ubuntu1+esm1
None known
golang-1.22
Ubuntu:20.04:LTS
From an advisory covering 12 CVEs
before 1.22.2-2~20.04.3, plus listed versions
1.22.2-2~20.04.11.22.2-2~20.04.2
1.22.2-2~20.04.3
golang-1.22
Ubuntu:22.04:LTS
From an advisory covering 12 CVEs
before 1.22.2-2~22.04.4, plus listed versions
1.22.2-2~22.041.22.2-2~22.04.11.22.2-2~22.04.21.22.2-2~22.04.3
1.22.2-2~22.04.4
golang-1.22
Ubuntu:24.04:LTS
From an advisory covering 12 CVEs
before 1.22.2-2ubuntu0.5, plus listed versions
1.22~rc1-21.22.0-11.22.0-21.22.1-11.22.1-1build1
Show 5 moreShow less
1.22.2-21.22.2-2ubuntu0.11.22.2-2ubuntu0.21.22.2-2ubuntu0.31.22.2-2ubuntu0.4
1.22.2-2ubuntu0.5
go1.26
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
before 1.26.9-1.1
1.26.9-1.1
go1.27
openSUSE:Tumbleweed
From an advisory covering 15 CVEs
before 1.27.2-1.1
1.27.2-1.1
rclone
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
before 1.75.2-1.1
1.75.2-1.1
vexctl
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
before 0.4.4+git106.aa6ffc8-1.1
0.4.4+git106.aa6ffc8-1.1
containerized-data-importer1.65
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
before 1.65.0-4.1
1.65.0-4.1
kubevirt1.8
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
before 1.8.4-7.1
1.8.4-7.1
kubevirt1.9
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
before 1.9.1-2.1
1.9.1-2.1
buildpacks-cli
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
before 0.40.10-1.1
0.40.10-1.1
git-bug
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
before 0.11.0-3.1
0.11.0-3.1
amazon-cloudwatch-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 1.300073.2-2.1
1.300073.2-2.1
azure-storage-azcopy
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 10.34.1-1.1
10.34.1-1.1
distribution
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
before 3.1.2-3.1
3.1.2-3.1
google-guest-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 20261022.00-1.1
20261022.00-1.1
google-osconfig-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 20261022.00-1.1
20261022.00-1.1
timoni
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
before 0.36.0-1.1
0.36.0-1.1
fleet-cli
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
before 0.16.3-1.1
0.16.3-1.1
helm
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
before 4.3.1-3.1
4.3.1-3.1
tempo-cli
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
before 3.1.1-1.1
3.1.1-1.1
alloy
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
before 1.21.3-1.1
1.21.3-1.1
go1.27
openSUSE:Leap 16.0
From an advisory covering 15 CVEs
before 1.27.2-160000.1.1
1.27.2-160000.1.1
go1.26
openSUSE:Leap 16.0
From an advisory covering 13 CVEs
before 1.26.9-160000.1.1
1.26.9-160000.1.1
kubevirt1.9
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
before 1.9.1-160000.1.1
1.9.1-160000.1.1
google-cloud-sap-agent
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
before 3.15-160000.5.1
3.15-160000.5.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, aliases_moreOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases
affected, aliases, referencesOSV
affectedOSV
affected
affectedOSV
affected, aliases, facts, referencesOSV
affected, aliases, referencesOSV
aliases, aliases_more
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78659 is a high vulnerability (CVSS 7.5) in Go Standard Library Net/http, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in docker 29.9.0-r0.

References

Show 168 moreShow less
This page doesn't list everything

Left out here: 26 versions. The JSON record has them. Also not on the record: 1 alias. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 50 source records.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open