traefik-3.7

3 results · Clear filters · Feed

• Critical 9.1
  CVE-2026-78663

  Double flow control refund on HTTP/2 server streams in net/http

  The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 8, 2026
• Critical 9.6
  CVE-2026-39821

  Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

  Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 22, 2026
• Critical 9.1
  CVE-2026-39834

  Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

  When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses in…

  golang.org/x/crypto golang.org/x/crypto/ssh zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  May 22, 2026