azurelinux-image-tools vulnerabilities (Azure Linux)

17 vulnerabilities.

• azurelinux-image-tools Azure Linux compress zstd: Panic on two-block frames CVE-2026-116591 Fix available 8.7 HighOctober 26, 2026
• azurelinux-image-tools Azure Linux HTTP/2 server crash due to HPACK encoder race in net/http CVE-2026-97032 Fix available 7.5 HighOctober 8, 2026
• azurelinux-image-tools Azure Linux Excessive CPU consumption from repeated initial window changes in net/http CVE-2026-78669 Fix available 7.5 HighOctober 8, 2026
• azurelinux-image-tools Azure Linux Double flow control refund on HTTP/2 server streams in net/http CVE-2026-78663 Fix available 9.1 CriticalOctober 8, 2026
• azurelinux-image-tools Azure Linux HTTP/2 transport accepts malformed framing-related headers in net/http CVE-2026-78660 Fix available 7.5 HighOctober 8, 2026
• azurelinux-image-tools Azure Linux HTTP/2 server memory exhaustion due to Trailer headers in net/http CVE-2026-78659 Fix available 7.5 HighOctober 8, 2026
• azurelinux-image-tools Azure Linux OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning CVE-2026-81871 Fix available 6.3 MediumSeptember 16, 2026
• azurelinux-image-tools Azure Linux OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full CVE-2026-81872 Fix available 6.3 MediumSeptember 16, 2026
• azurelinux-image-tools Azure Linux OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs CVE-2026-81870 Fix available 2.0 LowSeptember 16, 2026
• azurelinux-image-tools Azure Linux gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers CVE-2026-84445 Fix available 8.7 HighSeptember 4, 2026
• azurelinux-image-tools Azure Linux gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation CVE-2026-84304 Fix available 8.7 HighSeptember 1, 2026
• azurelinux-image-tools Azure Linux Infinite loop on invalid input in golang.org/x/text CVE-2026-56852 Public exploitFix available 7.5 HighJuly 14, 2026
• azurelinux-image-tools Azure Linux Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net CVE-2026-33814 Fix available 7.5 HighMay 7, 2026
• azurelinux-image-tools Azure Linux OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies CVE-2026-39882 Fix available 5.3 MediumApril 8, 2026
• azurelinux-image-tools Azure Linux OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVE-2026-29181 Fix available 7.5 HighApril 7, 2026
• azurelinux-image-tools Azure Linux Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net CVE-2026-27141 Fix available 7.5 HighFebruary 26, 2026
• azurelinux-image-tools Azure Linux Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna CVE-2026-39821 Fix available 9.6 CriticalNovember 5, 2016