{"id":"AZL-107033","summary":"CVE-2026-78660 affecting package azl-otel-collector 0.127.0-1","details":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","modified":"2026-10-12T05:33:09Z","published":"2026-10-08T23:17:03Z","upstream":["CVE-2026-78660"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660"}],"affected":[{"package":{"name":"azl-otel-collector","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/azl-otel-collector"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.127.0-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107033.json"}}],"schema_version":"1.9.0"}