{"id":"AZL-107901","summary":"CVE-2026-78660 affecting package sriov-network-device-plugin 3.7.0-8","details":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","modified":"2026-10-11T14:17:29.549084847Z","published":"2026-10-08T23:17:03Z","upstream":["CVE-2026-78660"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660"}],"affected":[{"package":{"name":"sriov-network-device-plugin","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/sriov-network-device-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.7.0-8"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107901.json"}}],"schema_version":"1.9.0"}