Most recent entries from all

CLEANSTART-2026-EN61439 — HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (ref…

Affected: CleanStart: kube-logging-operator

Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.

fkie_cve-2026-78663

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

openSUSE-SU-2026:12101-1 — go1.27-1.27.2-1.1 on GA media

go1.27-1.27.2-1.1 on GA media

UBUNTU-CVE-2026-78663

Affected: Ubuntu:14.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.10, Ubuntu:16.04:LTS: golang-1.6, Ubuntu:Pro:16.04:LTS: golang-golang-x-net-dev, Ubuntu:Pro:16.04:LTS: juju-core, Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:16.04:LTS: containerd, Ubuntu:Pro:16.04:LTS: golang-1.13, Ubuntu:Pro:16.04:LTS: golang-1.18, Ubuntu:Pro:16.04:LTS: google-guest-agent and 56 more

[Unknown description]