{"id":"openSUSE-SU-2026:22180-1","summary":"Security update for kubevirt1.9","details":"This update for kubevirt1.9 fixes the following issues:\n\n- CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host (bsc#1272840).\n- CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286984).\n- CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287039).\n- CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287143).\n- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285255).\n- CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287446).\n\nUpdate to version 1.9.1:\n\n * virt-template is pinned at v0.2.3\n * several bug fixes, see\n https://github.com/kubevirt/kubevirt/releases/tag/v1.9.1\n","modified":"2026-10-31T18:00:09.494461296Z","published":"2026-10-28T17:31:38Z","related":["CVE-2026-13622","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78669","CVE-2026-97032"],"upstream":["CVE-2026-13622","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78669","CVE-2026-97032"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272840"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285255"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286984"},{"type":"REPORT","url":"https://bugzilla.suse.com/1287039"},{"type":"REPORT","url":"https://bugzilla.suse.com/1287143"},{"type":"REPORT","url":"https://bugzilla.suse.com/1287446"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-13622"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78659"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78660"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78663"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78669"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-97032"}],"affected":[{"package":{"name":"kubevirt1.9","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/kubevirt1.9&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"kubevirt1.9-virtctl":"1.9.1-160000.1.1","kubevirt1.9-sidecar-shim":"1.9.1-160000.1.1","kubevirt1.9-container-disk":"1.9.1-160000.1.1","kubevirt1.9-virt-api":"1.9.1-160000.1.1","kubevirt1.9-virt-launcher":"1.9.1-160000.1.1","kubevirt1.9-virt-exportserver":"1.9.1-160000.1.1","kubevirt1.9-tests":"1.9.1-160000.1.1","kubevirt1.9-virt-handler":"1.9.1-160000.1.1","kubevirt1.9-virt-controller":"1.9.1-160000.1.1","kubevirt1.9-libguestfs-tools":"1.9.1-160000.1.1","kubevirt1.9-virt-operator":"1.9.1-160000.1.1","kubevirt1.9-virt-synchronization-controller":"1.9.1-160000.1.1","kubevirt1.9-virt-exportproxy":"1.9.1-160000.1.1","kubevirt1.9-pr-helper-conf":"1.9.1-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22180-1.json"}}],"schema_version":"1.9.2"}