openSUSE-SU-2026:22180-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22180-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22180-1
Upstream
CVE (6)
  • CVE-2026-13622
  • CVE-2026-78659
  • CVE-2026-78660
  • CVE-2026-78663
  • CVE-2026-78669
  • CVE-2026-97032
Related
CVE (6)
  • CVE-2026-13622
  • CVE-2026-78659
  • CVE-2026-78660
  • CVE-2026-78663
  • CVE-2026-78669
  • CVE-2026-97032
Published
2026-10-28T17:31:38Z
Modified
2026-10-31T18:00:09Z
Summary
Security update for kubevirt1.9
Details

This update for kubevirt1.9 fixes the following issues:

  • CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host (bsc#1272840).
  • CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286984).
  • CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287039).
  • CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287143).
  • CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285255).
  • CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287446).

Update to version 1.9.1:

References

Affected packages

openSUSE:Leap 16.0 / kubevirt1.9

Package

Name
kubevirt1.9
Purl
pkg:rpm/opensuse/kubevirt1.9&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.9.1-160000.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "kubevirt1.9-container-disk":  "1.9.1-160000.1.1",
            "kubevirt1.9-libguestfs-tools":  "1.9.1-160000.1.1",
            "kubevirt1.9-pr-helper-conf":  "1.9.1-160000.1.1",
            "kubevirt1.9-sidecar-shim":  "1.9.1-160000.1.1",
            "kubevirt1.9-tests":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-api":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-controller":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-exportproxy":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-exportserver":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-handler":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-launcher":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-operator":  "1.9.1-160000.1.1",
            "kubevirt1.9-virt-synchronization-controller":  "1.9.1-160000.1.1",
            "kubevirt1.9-virtctl":  "1.9.1-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22180-1.json"