Summary
OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes.
Security Fix(es):
* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debuginfo | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-3.el10_3 |
| Rocky Linux · 10 | oci-seccomp-bpf-hook-debugsource | 0:1.3.0-3.el10_3 |
Vulnerabilities 4
-
High 7.5
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
-
High 7.5
Lack of limit on size of parsed Range headers in net/http
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
-
High 7.5
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
-
High 7.5
Reject malformed ECH outer extension references in crypto/tls
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and …