SUSE-SU-2026:5167-1: Security update for kubevirt
This update for kubevirt fixes the following issues:
- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278574). - CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286984). - CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287039). - CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287131). - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285255). - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279276). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279184). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278869). - CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287260).
Rebuilt also against current go1.26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/kubevirtto a version that resolves this vulnerability.Fixed in 1.7.4-150700.3.42.1 - Upgrade
Upgrade
Goto a version that resolves this vulnerability.Fixed in go1.26
Event History
Child vulnerabilities
Contains the following vulnerabilities.