{"id":"AZL-107105","summary":"CVE-2026-78660 affecting package podman 5.6.1-10","details":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","modified":"2026-10-12T05:33:09Z","published":"2026-10-08T23:17:03Z","upstream":["CVE-2026-78660"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660"}],"affected":[{"package":{"name":"podman","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/podman"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107105.json"}}],"schema_version":"1.9.0"}