openSUSE-SU-2026:22180-1
openSUSE-SU-2026:22180-1 · Security update for kubevirt1.9
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for kubevirt1.9 fixes the following issues: - CVE-2026-13622: virt-handler migration proxy follows symlinks allowing container escape to host (bsc#1272840). - CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286984). - CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287039). - CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287143). - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285255). - CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287446). Update to version 1.9.1: * virt-template is pinned at v0.2.3 * several bug fixes, see https://github.com/kubevirt/kubevirt/releases/tag/v1.9.1
Fix available
- Published
- Updated
Stack: system
Affected products and versions
kubevirt1.9 openSUSE:Leap 16.0
- Affected ranges
- ECOSYSTEM: < 1.9.1-160000.1.1
Update to 1.9.1-160000.1.1
Original sources
- https://bugzilla.suse.com/1272840
- https://bugzilla.suse.com/1285255
- https://bugzilla.suse.com/1286984
- https://bugzilla.suse.com/1287039
- https://bugzilla.suse.com/1287143
- https://bugzilla.suse.com/1287446
- https://www.suse.com/security/cve/CVE-2026-13622
- https://www.suse.com/security/cve/CVE-2026-78659
- https://www.suse.com/security/cve/CVE-2026-78660
- https://www.suse.com/security/cve/CVE-2026-78663
- https://www.suse.com/security/cve/CVE-2026-78669
- https://www.suse.com/security/cve/CVE-2026-97032
- https://osv.dev/vulnerability/openSUSE-SU-2026:22180-1