AZL-87233

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-87233.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-87233

Upstream

CVE-2026-39834

Published

2026-05-22T04:16:24Z

Modified

2026-08-30T05:24:52Z

Summary

CVE-2026-39834 affecting package cri-o 1.30.1-1

Details

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-39834

Affected packages

Azure Linux:3 / cri-o

Package

Name: cri-o
Purl: pkg:rpm/azure-linux/cri-o

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.30.1-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-87233.json"