kubeadm (1.33.13-ubuntu22.04u9) jammy; urgency=low

  * [CRITICAL] CVE-2026-33186 in google.golang.org/grpc (v1.68.1) - google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Author...
  * [HIGH] CVE-2025-47913 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client pani...
  * [HIGH] CVE-2026-24051 in go.opentelemetry.io/otel/sdk (v1.33.0) - OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijackin...
  * [HIGH] CVE-2026-25681 in golang.org/x/net (v0.38.0) - golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cr...
  * [HIGH] CVE-2026-27136 in golang.org/x/net (v0.38.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting vi...
  * [HIGH] CVE-2026-33814 in golang.org/x/net (v0.38.0) - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Servi...
  * [HIGH] CVE-2026-39821 in golang.org/x/net (v0.38.0) - golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege esc...
  * [HIGH] CVE-2026-39822 in stdlib (v1.26.4) - os: golang: Go os.Root: Symlink following vulnerability allows directory trav...
  * [HIGH] CVE-2026-39828 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execut...
  * [HIGH] CVE-2026-39829 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via craft...
  * [HIGH] CVE-2026-39830 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resou...
  * [HIGH] CVE-2026-39831 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to...
  * [HIGH] CVE-2026-39832 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass...
  * [HIGH] CVE-2026-39835 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service v...
  * [HIGH] CVE-2026-39883 in go.opentelemetry.io/otel/sdk (v1.33.0) - github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code...
  * [HIGH] CVE-2026-42508 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhost...
  * [HIGH] CVE-2026-46595 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to...
  * [HIGH] CVE-2026-46597 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via craft...
  * [HIGH] GHSA-hrxh-6v49-42gf in google.golang.org/grpc (v1.68.1) - gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
  * [MEDIUM] CVE-2025-47911 in golang.org/x/net (v0.38.0) - golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html
  * [MEDIUM] CVE-2025-47914 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to ma...
  * [MEDIUM] CVE-2025-58181 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbou...
  * [MEDIUM] CVE-2025-58190 in golang.org/x/net (v0.38.0) - golang.org/x/net/html: Infinite parsing loop in golang.org/x/net
  * [MEDIUM] CVE-2026-25680 in golang.org/x/net (v0.38.0) - golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excess...
  * [MEDIUM] CVE-2026-39827 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service v...
  * [MEDIUM] CVE-2026-39833 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass...
  * [MEDIUM] CVE-2026-39834 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service d...
  * [MEDIUM] CVE-2026-42502 in golang.org/x/net (v0.38.0) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting vi...
  * [MEDIUM] CVE-2026-42505 in stdlib (v1.26.4) - crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client...
  * [MEDIUM] CVE-2026-42506 in golang.org/x/net (v0.38.0) - golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via...
  * [MEDIUM] CVE-2026-46598 in golang.org/x/crypto (v0.36.0) - golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial...
  * [UNKNOWN] CVE-2026-39824 in golang.org/x/sys (v0.31.0) - Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
  * [UNKNOWN] CVE-2026-46600 in golang.org/x/net (v0.38.0) - Parsing an invalid SVCB or HTTPS RR can panic when the size of a param...
  * [UNKNOWN] CVE-2026-56852 in golang.org/x/text (v0.23.0) - A norm.Iter can enter an infinite loop when handling input containing...
 -- azcu-bot <azcu-publishing@microsoft.com>  Fri, 24 Jul 2026 00:00:00 +0000

