{"id":"CVE-2026-13201","aliases":["AZL-91173","EUVD-2026-39086","GHSA-rcfc-7m3g-h5xh","SUSE-SU-2026:3480-1","SUSE-SU-2026:3630-1","openSUSE-SU-2026:11392-1","openSUSE-SU-2026:11520-1","openSUSE-SU-2026:21590-1"],"status":"published","title":"Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption","description":"A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00308,"percentile":0.23799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2026-06-24T20:39:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.8.4-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-150700.3.33.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150700.15.17.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-160000.1.1"}]}],"bundled":25}],"products":[{"vendor":"kubevirt","product":"kubevirt"},{"vendor":"red hat","product":"red hat container native virtualization 4.12"},{"vendor":"red hat","product":"red hat container native virtualization 4.13"},{"vendor":"red hat","product":"red hat container native virtualization 4.14"},{"vendor":"red hat","product":"red hat container native virtualization 4.15"},{"vendor":"red hat","product":"red hat container native virtualization 4.16"},{"vendor":"red hat","product":"red hat container native virtualization 4.17"},{"vendor":"red hat","product":"red hat container native virtualization 4.18"},{"vendor":"red hat","product":"red hat container native virtualization 4.19"},{"vendor":"red hat","product":"red hat container native virtualization 4.20"},{"vendor":"red hat","product":"red hat container native virtualization 4.21"},{"vendor":"red hat","product":"red hat container native virtualization 4.22"},{"vendor":"redhat","product":"openshift_virtualization"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:51031","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53655","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53671","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53684","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53721","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53728","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53763","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53797","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53826","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53838","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80941","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13201","tags":["vdb-entry","x_refsource_REDHAT","Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492203","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13201","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rcfc-7m3g-h5xh"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263480-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266575","tags":["report"]},{"url":"https://bugzilla.suse.com/1269093","tags":["report"]},{"url":"https://bugzilla.suse.com/1271661","tags":["report"]},{"url":"https://bugzilla.suse.com/1272415","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251420","tags":["report"]},{"url":"https://bugzilla.suse.com/1251615","tags":["report"]},{"url":"https://bugzilla.suse.com/1253935","tags":["report"]},{"url":"https://bugzilla.suse.com/1254014","tags":["report"]},{"url":"https://bugzilla.suse.com/1262265","tags":["report"]},{"url":"https://bugzilla.suse.com/1265736","tags":["report"]},{"url":"https://bugzilla.suse.com/1267120","tags":["report"]},{"url":"https://bugzilla.suse.com/1272000","tags":["report"]},{"url":"https://bugzilla.suse.com/1272840","tags":["report"]},{"url":"https://bugzilla.suse.com/1273606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://bugzilla.suse.com/1266151","tags":["report"]},{"url":"https://bugzilla.suse.com/1272011","tags":["report"]},{"url":"https://bugzilla.suse.com/1272604","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-13201","title":"Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption","description":"A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.","status":"published","published":"2026-06-24T20:39:00.173Z","modified":"2026-10-12T20:47:23.283Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:19:50.24628Z"}],"euvd":[{"id":"EUVD-2026-39086","description":"A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.","status":"published","published":"2026-06-24T20:39:00Z","modified":"2026-10-12T20:47:23Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:21.690828Z"}],"ghsa":[{"id":"GHSA-rcfc-7m3g-h5xh","title":"A flaw was found in KubeVirt's safepath package. The OpenAtNoFollow function uses O_PATH...","description":"A flaw was found in KubeVirt's safepath package. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream helpers operate via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to cause virt-handler to apply file ownership or permission changes to an unintended host path.","status":"published","published":"2026-06-24T21:30:44Z","modified":"2026-10-12T21:32:50Z","cvss":[{"version":"3.1","score":5.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T15:13:08.654991Z"}],"nvd":[{"id":"CVE-2026-13201","description":"A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.","status":"published","published":"2026-06-24T21:16:52.42Z","modified":"2026-10-25T22:10:00.15Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:12:25.67873Z"}],"osv":[{"id":"AZL-91173","title":"CVE-2026-13201 affecting package kubevirt for versions less than 1.8.4-4","description":"A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash — resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.","status":"published","published":"2026-06-24T21:16:52Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"openSUSE-SU-2026:11392-1","title":"kubevirt1.8-container-disk-1.8.4-3.1 on GA media","description":"These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:26.544288898Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11520-1","title":"kubevirt1.9-container-disk-1.9.0-1.1 on GA media","description":"These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:04.212699903Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21590-1","title":"Security update for kubevirt1.8","description":"This update for kubevirt1.8 fixes the following issues:\n\nUpdate to version 1.8.4.\n\nSecurity issues fixed:\n\n- CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath `OpenAtNoFollow` symlink following via `/proc/self/fd` allows\n  host file metadata modification (bsc#1269093).\n- CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).\n- CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267120).\n- CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted `SETTINGS_MAX_FRAME_SIZE`\n  can lead to an infinite loop and a denial of service (bsc#1265736).\n- CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame\n  parser allows for a denial of service via crafted SPDY frames (bsc#1262265).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266575).\n- CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,\n  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598:\n  golang.org/x/crypto/ssh: multiple issues in `x/crypto/ssh` (bsc#1266151).\n- CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer\n  can lead to panic (bsc#1273606).\n- CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272011).\n\n Other updates and bugfixes:\n\n- Fix the release manifests' image references (bsc#1272604).\n- Add a `libguestfs-tools` subpackage.\n- Build with Go \u003e= 1.25 (required by `golang.org/x/net` 0.55).\n- Version 1.8.4:\n  * node-labeller: use new `libvirt` flags for full feature expansion.\n  * Fix gRPC connection leak in `GetLauncherClient`; clean up ghost launcher record on connection setup failure.\n  * api: validate `VMI VSOCK CID` and checksum status fields as `uint32`.\n  * virt-operator: refine canary flow to fully support out-of-band changes.\n  * New `virt-api`/`virt-handler`/`virt-operator` ready and down metrics, alerts and recording rules.\n- Refresh `disks-images-provider.yaml` to the v1.8.4 image tag.\n","status":"published","published":"2026-08-18T16:05:12Z","modified":"2026-08-21T09:15:09.273633061Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:3480-1","title":"Security update for kubevirt","description":"This update for kubevirt fixes the following issues:\n\n- Security update correcting a CVE over-claim from the previous\n  update, verified by auditing the fix code actually present in the\n  vendored tree:\n\n  * CVE-2026-39821 (bsc#1266575): the previous entry claimed this\n    fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0's\n    idna fix is compile-time gated on Unicode 16 tables, which only\n    exist for go1.27+ - it is inert in our go1.25 builds, so the\n    claim was incorrect. Re-vendor golang.org/x/net v0.55.0 -\u003e\n    v0.57.0, whose idna package rejects all-ASCII Punycode labels\n    unconditionally; the CVE is now actually fixed.\n\n- Re-vendor golang.org/x/text v0.37.0 -\u003e v0.40.0: CVE-2026-56852\n  (bsc#1271661), infinite loop on invalid input in unicode/norm.\n\n- golang.org/x/crypto v0.52.0 -\u003e v0.54.0 (pulled in by x/net 0.57.0;\n  no additional CVE claims, all previously listed x/crypto fixes\n  remain included).\n\n- CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last\n  component is a symlink without detecting it, allowing metadata\n  operations via /proc/self/fd to act on the symlink target.\n  Backports of upstream release-1.7 commits 9ecda4ad5e and\n  1494cee849.\n- x/net 0.57.0 also contains the fix for CVE-2026-46600\n  (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that\n  package (not affected), the bump merely rides past it.\n","status":"published","published":"2026-08-04T11:42:30Z","modified":"2026-08-05T18:23:50.365428527Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3630-1","title":"Security update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6","description":"This update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6 fixes the following issues:\n\n  \n- CVE-2025-47911: golang.org/x/net/html: algorithms that have quadratic complexity when parsing HTML documents allow\n  for denial of service (bsc#1251420).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: no validation of message size when processing new identity requests\n  can cause a panic due to an out-of-bounds read (bsc#1254014).\n- CVE-2025-58181: golang.org/x/crypto/ssh: no validation of number of mechanisms in GSSAPI authentication requests can\n  cause unbounded memory consumption (bsc#1253935).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input can lead to a denial of service (bsc#1251615).\n- CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath `OpenAtNoFollow` symlink following via `/proc/self/fd` allows\n  host file metadata modification (bsc#1269093).\n- CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).  \n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267120).\n- CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted `SETTINGS_MAX_FRAME_SIZE`\n  can lead to an infinite loop and a denial of service (bsc#1265736).\n- CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame\n  parser allows for a denial of service via crafted SPDY frames (bsc#1262265).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266575).\n- CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer\n  can lead to panic (bsc#1273606).\n- CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272000).\n\nOther updates and bugfixes:\n\n- Fixed `printf`-style calls with non-constant format strings (`cmd/virt-chroot`, `tests/`) that fail `go1.25`'s vet\n  (toolchain required by the `x/net` 0.55.0 re-vendor); rewritten with no behavior change.\n- Build with Go \u003e= 1.25 (required by `golang.org/x/net` 0.55).\n","status":"published","published":"2026-08-17T16:50:34Z","modified":"2026-08-18T09:30:04.678726857Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}