{"id":"CVE-2026-13622","aliases":["AZL-111641","AZL-95943","EUVD-2026-57615","GHSA-4336-pf6g-hp94","SUSE-SU-2026:3604-1","SUSE-SU-2026:3630-1","openSUSE-SU-2026:11752-1","openSUSE-SU-2026:12227-1","openSUSE-SU-2026:21590-1","openSUSE-SU-2026:22180-1"],"status":"published","title":"Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/\u003cpid\u003e/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00202,"percentile":0.1017,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-12T20:46:15Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.8.4-4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","fixed_in":["1.7.4-150700.3.36.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.8","fixed_in":["1.8.4-6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt-openvmm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-150700.3.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"kubevirt-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150700.15.17.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kubevirt1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-160000.1.1"}]}],"bundled":25},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kubevirt1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"red hat","product":"red hat container native virtualization 4.12"},{"vendor":"red hat","product":"red hat container native virtualization 4.13"},{"vendor":"red hat","product":"red hat container native virtualization 4.14"},{"vendor":"red hat","product":"red hat container native virtualization 4.15"},{"vendor":"red hat","product":"red hat container native virtualization 4.16"},{"vendor":"red hat","product":"red hat container native virtualization 4.17"},{"vendor":"red hat","product":"red hat container native virtualization 4.18"},{"vendor":"red hat","product":"red hat container native virtualization 4.19"},{"vendor":"red hat","product":"red hat container native virtualization 4.20"},{"vendor":"red hat","product":"red hat container native virtualization 4.21"},{"vendor":"red hat","product":"red hat container native virtualization 4.22"}],"references":[{"url":"https://access.redhat.com/errata/RHEA-2026:53670","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51031","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53655","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53671","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53684","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53721","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53728","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53763","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53797","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53826","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53838","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13622","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494142","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13622","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4336-pf6g-hp94"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272840","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13622","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251420","tags":["report"]},{"url":"https://bugzilla.suse.com/1251615","tags":["report"]},{"url":"https://bugzilla.suse.com/1253935","tags":["report"]},{"url":"https://bugzilla.suse.com/1254014","tags":["report"]},{"url":"https://bugzilla.suse.com/1262265","tags":["report"]},{"url":"https://bugzilla.suse.com/1265736","tags":["report"]},{"url":"https://bugzilla.suse.com/1266575","tags":["report"]},{"url":"https://bugzilla.suse.com/1267120","tags":["report"]},{"url":"https://bugzilla.suse.com/1269093","tags":["report"]},{"url":"https://bugzilla.suse.com/1272000","tags":["report"]},{"url":"https://bugzilla.suse.com/1273606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://bugzilla.suse.com/1266151","tags":["report"]},{"url":"https://bugzilla.suse.com/1272011","tags":["report"]},{"url":"https://bugzilla.suse.com/1272604","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]},{"url":"https://bugzilla.suse.com/1285255","tags":["report"]},{"url":"https://bugzilla.suse.com/1286984","tags":["report"]},{"url":"https://bugzilla.suse.com/1287039","tags":["report"]},{"url":"https://bugzilla.suse.com/1287143","tags":["report"]},{"url":"https://bugzilla.suse.com/1287446","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-13622","title":"Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/\u003cpid\u003e/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","status":"published","published":"2026-08-12T20:46:15.766Z","modified":"2026-09-21T16:31:52.204Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-57615","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/\u003cpid\u003e/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","status":"published","published":"2026-08-12T20:46:15Z","modified":"2026-09-21T16:31:52Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:05.032636Z"}],"ghsa":[{"id":"GHSA-4336-pf6g-hp94","title":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During...","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/\u003cpid\u003e/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","status":"published","published":"2026-08-12T21:31:44Z","modified":"2026-08-14T12:32:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:10:28.576497Z"}],"nvd":[{"id":"CVE-2026-13622","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/\u003cpid\u003e/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","status":"published","published":"2026-08-12T21:17:35.63Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"AZL-111641","title":"CVE-2026-13622 affecting package kubevirt-openvmm 1.9.0-1","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/\u003cpid\u003e/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","status":"published","published":"2026-08-12T21:17:35Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-95943","title":"CVE-2026-13622 affecting package kubevirt for versions less than 1.8.4-4","description":"A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/\u003cpid\u003e/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.","status":"published","published":"2026-08-12T21:17:35Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"openSUSE-SU-2026:11752-1","title":"kubevirt1.9-container-disk-1.9.0-3.1 on GA media","description":"These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-11T00:00:00Z","modified":"2026-09-12T10:30:05.339908969Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12227-1","title":"kubevirt1.8-container-disk-1.8.4-6.1 on GA media","description":"These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-22T00:00:00Z","modified":"2026-10-23T17:23:11.660630687Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21590-1","title":"Security update for kubevirt1.8","description":"This update for kubevirt1.8 fixes the following issues:\n\nUpdate to version 1.8.4.\n\nSecurity issues fixed:\n\n- CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath `OpenAtNoFollow` symlink following via `/proc/self/fd` allows\n  host file metadata modification (bsc#1269093).\n- CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).\n- CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-42502, CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267120).\n- CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted `SETTINGS_MAX_FRAME_SIZE`\n  can lead to an infinite loop and a denial of service (bsc#1265736).\n- CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame\n  parser allows for a denial of service via crafted SPDY frames (bsc#1262265).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266575).\n- CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,\n  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598:\n  golang.org/x/crypto/ssh: multiple issues in `x/crypto/ssh` (bsc#1266151).\n- CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer\n  can lead to panic (bsc#1273606).\n- CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272011).\n\n Other updates and bugfixes:\n\n- Fix the release manifests' image references (bsc#1272604).\n- Add a `libguestfs-tools` subpackage.\n- Build with Go \u003e= 1.25 (required by `golang.org/x/net` 0.55).\n- Version 1.8.4:\n  * node-labeller: use new `libvirt` flags for full feature expansion.\n  * Fix gRPC connection leak in `GetLauncherClient`; clean up ghost launcher record on connection setup failure.\n  * api: validate `VMI VSOCK CID` and checksum status fields as `uint32`.\n  * virt-operator: refine canary flow to fully support out-of-band changes.\n  * New `virt-api`/`virt-handler`/`virt-operator` ready and down metrics, alerts and recording rules.\n- Refresh `disks-images-provider.yaml` to the v1.8.4 image tag.\n","status":"published","published":"2026-08-18T16:05:12Z","modified":"2026-08-21T09:15:09.273633061Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:22180-1","title":"Security update for kubevirt1.9","description":"This update for kubevirt1.9 fixes the following issues:\n\n- CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host (bsc#1272840).\n- CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286984).\n- CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287039).\n- CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287143).\n- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285255).\n- CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287446).\n\nUpdate to version 1.9.1:\n\n * virt-template is pinned at v0.2.3\n * several bug fixes, see\n https://github.com/kubevirt/kubevirt/releases/tag/v1.9.1\n","status":"published","published":"2026-10-28T17:31:38Z","modified":"2026-10-31T18:00:09.494461296Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:3604-1","title":"Security update for kubevirt","description":"This update for kubevirt fixes the following issue:\n\n- CVE-2026-13622: `virt-handler` migration proxy follows symlinks, allowing container escape to host (bsc#1272840).\n","status":"published","published":"2026-08-13T06:19:02Z","modified":"2026-08-14T10:30:27.055929357Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3630-1","title":"Security update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6","description":"This update for kubevirt-1.6, virt-api-container-1.6, virt-controller-container-1.6, virt-exportproxy-container-1.6, virt-exportserver-container-1.6, virt-handler-container-1.6, virt-launcher-container-1.6, virt-libguestfs-tools-container-1.6, virt-operator-container-1.6, virt-pr-helper-container-1.6, virt-synchronization-controller-container-1.6 fixes the following issues:\n\n  \n- CVE-2025-47911: golang.org/x/net/html: algorithms that have quadratic complexity when parsing HTML documents allow\n  for denial of service (bsc#1251420).\n- CVE-2025-47914: golang.org/x/crypto/ssh/agent: no validation of message size when processing new identity requests\n  can cause a panic due to an out-of-bounds read (bsc#1254014).\n- CVE-2025-58181: golang.org/x/crypto/ssh: no validation of number of mechanisms in GSSAPI authentication requests can\n  cause unbounded memory consumption (bsc#1253935).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n  crafted input can lead to a denial of service (bsc#1251615).\n- CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath `OpenAtNoFollow` symlink following via `/proc/self/fd` allows\n  host file metadata modification (bsc#1269093).\n- CVE-2026-13622: virt-handler migration proxy follows symlinks and allows container escape to host (bsc#1272840).  \n- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues\n  when parsing HTML files (bsc#1267120).\n- CVE-2026-33814: golang.org/x/net/http2: processing of HTTP/2 SETTINGS frames with a crafted `SETTINGS_MAX_FRAME_SIZE`\n  can lead to an infinite loop and a denial of service (bsc#1265736).\n- CVE-2026-35469: github.com/moby/spdystream: improper validation of attacker-controlled input in the SPDY/3 frame\n  parser allows for a denial of service via crafted SPDY frames (bsc#1262265).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266575).\n- CVE-2026-46600: parsing of invalid SVCB or HTTPS RR when the size of a parameter value overflows the message buffer\n  can lead to panic (bsc#1273606).\n- CVE-2026-56852: improper handling of truncated/invalid UTF-8 input can lead to an infinite loop (bsc#1272000).\n\nOther updates and bugfixes:\n\n- Fixed `printf`-style calls with non-constant format strings (`cmd/virt-chroot`, `tests/`) that fail `go1.25`'s vet\n  (toolchain required by the `x/net` 0.55.0 re-vendor); rewritten with no behavior change.\n- Build with Go \u003e= 1.25 (required by `golang.org/x/net` 0.55).\n","status":"published","published":"2026-08-17T16:50:34Z","modified":"2026-08-18T09:30:04.678726857Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}