rpm package
suse/kubevirt-1.6&distro=SUSE Linux Enterprise Module for Containers 15 SP7
pkg:rpm/suse/kubevirt-1.6&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-7374 | Cri | 9.9 | < 1.6.6-150700.15.7.1 | 1.6.6-150700.15.7.1 | May 26, 2026 | A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket | |
| CVE-2026-33186 | Cri | 9.1 | < 1.6.6-150700.15.7.1 | 1.6.6-150700.15.7.1 | Mar 20, 2026 | gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omi | |
| CVE-2025-58190 | — | < 1.6.6-150700.15.7.1 | 1.6.6-150700.15.7.1 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | ||
| CVE-2025-47911 | — | < 1.6.6-150700.15.7.1 | 1.6.6-150700.15.7.1 | Feb 5, 2026 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content. | ||
| CVE-2025-47914 | — | < 1.6.6-150700.15.7.1 | 1.6.6-150700.15.7.1 | Nov 19, 2025 | SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. | ||
| CVE-2025-58181 | — | < 1.6.6-150700.15.7.1 | 1.6.6-150700.15.7.1 | Nov 19, 2025 | SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. | ||
| CVE-2025-47913 | — | < 1.6.6-150700.15.7.1 | 1.6.6-150700.15.7.1 | Nov 13, 2025 | SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. |
- affected < 1.6.6-150700.15.7.1fixed 1.6.6-150700.15.7.1
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket
- affected < 1.6.6-150700.15.7.1fixed 1.6.6-150700.15.7.1
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omi
- CVE-2025-58190Feb 5, 2026affected < 1.6.6-150700.15.7.1fixed 1.6.6-150700.15.7.1
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- CVE-2025-47911Feb 5, 2026affected < 1.6.6-150700.15.7.1fixed 1.6.6-150700.15.7.1
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- CVE-2025-47914Nov 19, 2025affected < 1.6.6-150700.15.7.1fixed 1.6.6-150700.15.7.1
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
- CVE-2025-58181Nov 19, 2025affected < 1.6.6-150700.15.7.1fixed 1.6.6-150700.15.7.1
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
- CVE-2025-47913Nov 13, 2025affected < 1.6.6-150700.15.7.1fixed 1.6.6-150700.15.7.1
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.