Skip to content
OpenAdvisories

Package · Azure Linux

vitess

42 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-104252

    Vitess vttablet /twopcz reflected XSS

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a …

    vitessio vitess vitess vitess.io/vitess Azure Linux Go
  • Critical 9.1
    CVE-2026-78663

    Double flow control refund on HTTP/2 server streams in net/http

    The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 9.6
    CVE-2026-39821

    Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

    Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 9.3
    CVE-2026-27969

    Vitess users with backup storage access can write to arbitrary file paths on restore

    Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — …

    vitessio vitess vitess vitess.io/vitess Azure Linux Go