azure linux docker-buildx vulnerabilities

Latest azure linux docker-buildx CVEs

Newest publication first · page 1 of 2

1. CVE-2026-121520 Malicious client could set xattr value outside of BuildKit state directory

   Published 2026-11-03

   Medium·CVSS 4.5 EPSS 0.14%

   In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be se...

2. CVE-2026-97045 Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

   Published 2026-10-27

   Medium·CVSS 6.1 EPSS 0.27%

   In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyp...

3. CVE-2026-78661 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

   Published 2026-10-27

   High·CVSS 7.5 EPSS 0.41%

   When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (...

4. CVE-2026-116591 compress zstd: Panic on two-block frames

   Published 2026-10-26

   High·CVSS 8.7 EPSS 0.33%

   compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count al...

5. CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.68%

   HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to...

6. CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.85%

   A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

7. CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.54%

   Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client...

8. CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.87%

   When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

9. CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses

   Published 2026-10-07

   High·CVSS 7.6 EPSS 0.09%

   Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecu...

10. CVE-2026-81870 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

    Published 2026-09-16

    Low·CVSS 2.0 EPSS 0.27%

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client conf...

11. CVE-2026-84445 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

    Published 2026-09-14

    High·CVSS 8.7 EPSS 0.64%

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/se...

12. CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

    Published 2026-09-02

    High·CVSS 7.5 EPSS 0.43%

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such...

13. CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

    Published 2026-09-02

    High·CVSS 7.5 EPSS 0.50%

    Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and t...

14. CVE-2026-84304 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

    Published 2026-09-01

    High·CVSS 8.7 EPSS 0.61%

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain...

15. CVE-2026-37236 grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST reque...

    Published 2026-08-28

    Critical·CVSS 9.8 EPSS 0.43%

    grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the...

16. CVE-2026-61711 BuildKit: Custom frontend could bypass Seccomp/AppArmor

    Published 2026-08-19

    Medium·CVSS 5.3 EPSS 0.36%

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a crafted build request, and executor/oci/spec_linux.go treated the unsupported v...

17. CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text

    Published 2026-07-21

    High·CVSS 7.5 EPSS 0.48%

    A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

18. CVE-2026-39824 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

    Published 2026-05-22

    Low·CVSS 3.3 EPSS 0.11%

    NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

19. CVE-2026-27136 Invoking duplicate attributes can cause XSS in golang.org/x/net/html

    Published 2026-05-22

    Medium·CVSS 6.1 EPSS 0.26%

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

20. CVE-2026-39821 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

    Published 2026-05-22

    High·CVSS 8.2 EPSS 1.8%

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program...

21. CVE-2026-25681 Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

    Published 2026-05-22

    Medium·CVSS 6.1 EPSS 0.26%

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

22. CVE-2026-25680 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

    Published 2026-05-22

    Medium·CVSS 6.5 EPSS 0.33%

    Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

23. CVE-2026-42506 Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

    Published 2026-05-22

    Medium·CVSS 6.1 EPSS 0.24%

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

24. CVE-2026-42502 Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

    Published 2026-05-22

    Medium·CVSS 6.1 EPSS 0.22%

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

25. CVE-2026-46595 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

    Published 2026-05-22

    High·CVSS 7.1 EPSS 0.56%

    Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.